CVE-2026-49837

GoBGP (open source BGP implementation in Go) versions prior to 4.6.0 contain a boundary validation flaw in the BGP OPEN capability parser. Several capability decoders read from the full remaining buffer instead of the slice bounded by the declared CapLen , allowing a malformed OPEN message to cau...

CVE-2026-49837 GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded b...

CLSA-2026-1778170790 quagga: Fix of CVE-2018-5381

CVE-2018-5381: bgpd capability parser can enter an infinite loop on invalid OPEN messages whose Multi-Protocol capability has an unrecognized AFI/SAFI, causing a denial of service...

CLSA-2026-1777946639 quagga: Fix of CVE-2018-5381

CVE-2018-5381: bgpd capability parser can enter an infinite loop on invalid OPEN messages whose Multi-Protocol capability has an unrecognized AFI/SAFI, causing a denial of service...

CVE-2026-33516

CVE-2026-33516 affects xrdp (open source RDP server). Versions up to 0.10.5 contain an out-of-bounds read during the RDP capability exchange, triggered when memory is accessed before validating the remaining buffer length. A remote, unauthenticated attacker can exploit this by sending a crafted C...

UBUNTU-CVE-2018-5381

The Quagga BGP daemon bgpd prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgppacket.c:bgpcapabilitymsgparse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI,...