Is CVE-2026-49837 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49837 being exploited in the wild.

How severe is CVE-2026-49837?

Medium severity, with a CVSS score of 5.9, published 10 September 2026.

Which products and versions are affected?

github.com/osrg/gobgp/v4 (Go) <= 4.5.0, SEMVER:introduced=0,fixed=4.6.0; Osrg Gobgp <= 4.5.0.

Is there a fix for CVE-2026-49837?

Yes. github.com/osrg/gobgp/v4 (Go): upgrade to 4.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49837 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-49837?

Check whether you run github.com/osrg/gobgp/v4 (Go) or Osrg Gobgp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49837: GoBGP out-of-bounds read in BGP OPEN capability parser

Q: Is there a fix for CVE-2026-49837?

Yes. github.com/osrg/gobgp/v4 (Go): upgrade to 4.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49837 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-49837?

Check whether you run github.com/osrg/gobgp/v4 (Go) or Osrg Gobgp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49837 · Severity: medium · CVSS 5.9 · Published 2026-09-10

GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) used for routing internet traffic. A flaw in how it processes connection requests allows a remote attacker to send specially crafted messages that trick the system into misidentifying the identity or capabilities of a connecting peer. This can lead to unauthorized session establishment or the incorrect application of routing policies, potentially disrupting network stability.

Technologies: github.com/osrg/gobgp/v4 (Go), Osrg Gobgp. Vendors: Go, Osrg.

Quick answers

Is CVE-2026-49837 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49837 being exploited in the wild.
How severe is CVE-2026-49837?: Medium severity, with a CVSS score of 5.9, published 10 September 2026.
Which products and versions are affected?: github.com/osrg/gobgp/v4 (Go) <= 4.5.0, SEMVER:introduced=0,fixed=4.6.0; Osrg Gobgp <= 4.5.0.
Is there a fix for CVE-2026-49837?: Yes. github.com/osrg/gobgp/v4 (Go): upgrade to 4.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49837 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-49837?: Check whether you run github.com/osrg/gobgp/v4 (Go) or Osrg Gobgp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/osrg/gobgp/v4 (Go): upgrade to 4.6.0 or later
```
go get github.com/osrg/gobgp/v4@v4.6.0
```

Technical details

An out-of-bounds read vulnerability exists in the BGP OPEN capability parser within `pkg/packet/bgp/bgp.go` and `pkg/packet/bgp/validate.go`. While the generic parser identifies the declared `CapLen`, specific decoders (such as the 4-octet AS capability) fail to limit their read operations to that boundary, instead reading from the entire remaining buffer. A remote attacker can exploit this by sending a malformed OPEN message with a `CapLen` of 0, forcing the parser to consume bytes from subsequent capabilities. This can result in incorrect peer AS validation and session establishment decisions. The issue is addressed in version 4.6.0.

Affected products

osrg gobgp/v4 <= 4.5.0

Identifiers

CVE-2026-49837
GHSA-gjrg-jjr3-56cm
GO-2026-5955

Timeline

2026-06-02: disclosed
2026-07-09: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.