TI-2026-36742 Aliases CVE-2026-49838 GHSA-frrj-87jh-2772

GoBGP confederation validation panics on empty AS_PATH attribute

LOW 27CWE-129Published 2026-09-10 · Updated 2026-09-11

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-129 and the CVSS impact.

Summary

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00412 35th percentileScored 2026-11-07

Fix Partial gobgp (osrg): 4.7.0github.com/osrg/gobgp/v4 (Go): 4.7.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
osrg	gobgp	before 4.7.0	4.7.0	Patch available	CNA
—	github.com/osrg/gobgp/v4 (Go)	before 4.7.0	4.7.0	Patch available	GHSA-frrj-87jh-2772

gobgp Vendorosrg Affected before 4.7.0 Fixed in 4.7.0 Patch available CNA
github.com/osrg/gobgp/v4 (Go) Vendor— Affected before 4.7.0 Fixed in 4.7.0 Patch available GHSA-frrj-87jh-2772

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:osrg:gobgp::::::::	—	—	osrg

cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:* Versions — — ·osrg

Remediation

Fix · CNA gobgp (osrg) Fixed in 4.7.0
Fix · GHSA-frrj-87jh-2772 github.com/osrg/gobgp/v4 (Go) Fixed in 4.7.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2026-49838
2026-10-03 Alias added: GHSA-frrj-87jh-2772

References

Other 3

TI-2026-30596 GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) CVSS 3.1HIGH 7.5
TI-2026-30162 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE CVSS 3.1HIGH 7.5
TI-2026-30161 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute CVSS 3.1HIGH 7.5
TI-2026-23526 An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute CVSS 3.1HIGH 7.5
TI-2025-28529 An issue was discovered in GoBGP before 3.35.0. CVSS 3.1HIGH 8.6
TI-2025-28531 An issue was discovered in GoBGP before 3.35.0. CVSS 3.1CRITICAL 9.8

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences