Quick answers
- Is CVE-2026-49838 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-49838 being exploited in the wild.
- How severe is CVE-2026-49838?
- Medium severity, with a CVSS score of 5.9, published 10 September 2026.
- Which products and versions are affected?
- github.com/osrg/gobgp/v4 (Go) <= 4.6.0, SEMVER:introduced=0,fixed=4.7.0; Osrg Gobgp <= 4.6.0.
- Is there a fix for CVE-2026-49838?
- Yes. github.com/osrg/gobgp/v4 (Go): upgrade to 4.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-49838 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-49838?
- Check whether you run github.com/osrg/gobgp/v4 (Go) or Osrg Gobgp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- github.com/osrg/gobgp/v4 (Go): upgrade to 4.7.0 or later
go get github.com/osrg/gobgp/v4@v4.7.0
Technical details
A vulnerability in GoBGP's BGP UPDATE message validator leads to a denial of service. The root cause is an improper validation of the AS_PATH attribute; specifically, the `PathAttributeAsPath.DecodeFromBytes` function returns a nil error for zero-length attributes, leaving the internal value array empty. When a confederation eBGP peer is configured, the validator attempts to access the first element of this empty array (`p.Value[0]`) without a bounds check, triggering a Go runtime panic. An unauthenticated remote peer can exploit this by establishing a BGP session and sending a single malformed UPDATE message. This issue is addressed in version 4.7.0.
Affected products
- osrg GoBGP <= 4.6.0
Identifiers
- CVE-2026-49838
- GHSA-frrj-87jh-2772
- GO-2026-5954
Timeline
- 2026-06-30: disclosed
- 2026-07-09: advisory: GitHub Advisory published