TI-2026-36741 Aliases CVE-2026-49837 GHSA-gjrg-jjr3-56cm

GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

LOW 26CWE-125Published 2026-09-10 · Updated 2026-09-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00332 26th percentileScored 2026-11-07

Fix Fixed gobgp (osrg): 4.6.0github.com/osrg/gobgp/v4 (Go): 4.6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
osrg	gobgp	before 4.6.0	4.6.0	Patch available	CNA
—	github.com/osrg/gobgp/v4 (Go)	before 4.6.0	4.6.0	Patch available	GHSA-gjrg-jjr3-56cm

gobgp Vendorosrg Affected before 4.6.0 Fixed in 4.6.0 Patch available CNA
github.com/osrg/gobgp/v4 (Go) Vendor— Affected before 4.6.0 Fixed in 4.6.0 Patch available GHSA-gjrg-jjr3-56cm

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:osrg:gobgp::::::::	—	—	osrg

cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:* Versions — — ·osrg

Remediation

Fix · CNA gobgp (osrg) Fixed in 4.6.0
Fix · GHSA-gjrg-jjr3-56cm github.com/osrg/gobgp/v4 (Go) Fixed in 4.6.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 1 product

Red Hat OpenShift Container Platform 4

Timeline

2026-10-02 Threatist record created from CVE-2026-49837
2026-10-03 Alias added: GHSA-gjrg-jjr3-56cm

References

Other 3

TI-2026-30596 GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) CVSS 3.1HIGH 7.5
TI-2026-30162 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE CVSS 3.1HIGH 7.5
TI-2026-30161 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute CVSS 3.1HIGH 7.5
TI-2026-23526 An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute CVSS 3.1HIGH 7.5
TI-2025-28529 An issue was discovered in GoBGP before 3.35.0. CVSS 3.1HIGH 8.6
TI-2025-28531 An issue was discovered in GoBGP before 3.35.0. CVSS 3.1CRITICAL 9.8

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences