Executive brief
GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) used for routing internet traffic. A flaw in how it processes connection requests allows a remote attacker to send specially crafted messages that trick the system into misidentifying the identity or capabilities of a connecting peer. This can lead to unauthorized session establishment or the incorrect application of routing policies, potentially disrupting network stability.
Technical details
An out-of-bounds read vulnerability exists in the BGP OPEN capability parser within `pkg/packet/bgp/bgp.go` and `pkg/packet/bgp/validate.go`. While the generic parser identifies the declared `CapLen`, specific decoders (such as the 4-octet AS capability) fail to limit their read operations to that boundary, instead reading from the entire remaining buffer. A remote attacker can exploit this by sending a malformed OPEN message with a `CapLen` of 0, forcing the parser to consume bytes from subsequent capabilities. This can result in incorrect peer AS validation and session establishment decisions. The issue is addressed in version 4.6.0.
Affected products
- osrg gobgp/v4 <= 4.5.0
Timeline
- 2026-06-02: disclosed
- 2026-07-09: advisory: GitHub Advisory published