CVE-2026-49837: osrg gobgp Out-of-bounds Read

Vulnerability summary

CVE-2026-49837 is a medium (CVSS 5.9) Out-of-bounds Read vulnerability in osrg gobgp. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.9% of scored vulnerabilities.

Timeline

1. 10-09-2026
   PublishedVulnerability first disclosed.
2. 15-09-2026
   Last modifiedVulnerability information updated.

Description

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.