CVE-2026-49837 GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries
A malformed BGP OPEN message can cause the parser to read adjacent memory, potentially leaking data or bypassing peer AS validation checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49837?
CVE-2026-49837 is a medium-severity vulnerability in osrg gobgp, published on 10 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.
Weakness: CWE-125
Which versions are affected by CVE-2026-49837?
3 open source packages ship an affected version, including github.com/osrg/gobgp/v4.
| Package | Affected | Fixed in |
|---|---|---|
github.com/osrg/gobgp/v4 Go | All versions | 4.6.0 |
github.com/osrg/gobgp/v4 Go | All versions | 4.6.0 |
github.com/osrg/gobgp/v4 Go | All versions | 4.6.0 |
How do I fix CVE-2026-49837?
Upgrade github.com/osrg/gobgp/v4 to 4.6.0 or later.
Is CVE-2026-49837 being exploited?
There is no known exploitation of CVE-2026-49837 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-49837, GHSA-gjrg-jjr3-56cm, GO-2026-5955, UBUNTU-CVE-2026-49837.