CVE-2026-49838: GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a

Executive brief

GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) used to manage network routing. A vulnerability exists where a specially crafted routing update can cause the software to crash. This allows a remote attacker to disrupt network operations and cause a denial of service for affected routing sessions.

Technical details

A vulnerability in GoBGP's BGP UPDATE message validator leads to a denial of service. The root cause is an improper validation of the AS_PATH attribute; specifically, the `PathAttributeAsPath.DecodeFromBytes` function returns a nil error for zero-length attributes, leaving the internal value array empty. When a confederation eBGP peer is configured, the validator attempts to access the first element of this empty array (`p.Value[0]`) without a bounds check, triggering a Go runtime panic. An unauthenticated remote peer can exploit this by establishing a BGP session and sending a single malformed UPDATE message. This issue is addressed in version 4.7.0.

Affected products

• osrg GoBGP <= 4.6.0

Timeline

• 2026-06-30: disclosed
• 2026-07-09: advisory: GitHub Advisory published

References

• https://api.github.com/users/acorn421
• https://github.com/acorn421
• https://api.github.com/users/acorn421/gists%7B/gist_id%7D
• https://api.github.com/users/acorn421/repos
• https://avatars.githubusercontent.com/u/3205042?v=4
• https://api.github.com/users/acorn421/events%7B/privacy%7D