CVE-2026-49838: osrg gobgp Improper Validation of Array Index

Vulnerability summary

CVE-2026-49838 is a medium (CVSS 5.9) Improper Validation of Array Index vulnerability in osrg gobgp. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34% of scored vulnerabilities.

Timeline

1. 10-09-2026
   PublishedVulnerability first disclosed.
2. 11-09-2026
   Last modifiedVulnerability information updated.

Description

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.

• CWE-129Improper Validation of Array IndexThe product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.