CVE-2026-49837

A flaw was found in GoBGP, an open-source Border Gateway Protocol BGP implementation. A remote attacker could send a specially crafted BGP OPEN message, causing the BGP OPEN capability parser to misinterpret data. This issue arises because the parser may read capability values beyond their declar...

CVE-2026-49838

A flaw was found in GoBGP, an open-source Border Gateway Protocol BGP implementation. A configured confederation eBGP peer can send a specially crafted BGP UPDATE message with a zero-length ASPATH attribute. This malformed message is improperly handled during validation, leading to an unchecked...

The vulnerability of the DecodeFromBytes() function in the pkg/packet/bgp/bgp.go file of the BGP OPEN Message Handler component of the GoBGP protocol allows a attacker to increase their privileges.

The vulnerability of the DecodeFromBytes function in the pkg/packet/bgp/bgp.go file of the BGP OPEN Message Handler component is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

The vulnerability of the DecodeFromBytes() function in the pkg/packet/bgp/bgp.go file of the GoBGP edge gateway protocol allows a attacker to cause a service failure.

The vulnerability of the DecodeFromBytes function in the pkg/packet/bgp/bgp.go file of the GoBGP edge gateway protocol is related to a single-bit offset error. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the decoder handlers in the BGP OPEN messages parser of the GoBGP edge gateway module pkg/packet/bbg protocol allows a attacker to cause a service failure.

The vulnerability of the decoder handlers for BGP OPEN messages in the GoBGP border gateway module’s pkg/packet/bbg protocol relates to unvalidated array indexing. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the UpdatePathAttrs4ByteAs() function in the GoBGP edge gateway protocol’s internal/pkg/table/message.go file allows a attacker to cause a service failure.

The vulnerability of the UpdatePathAttrs4ByteAs function in the GoBGP edge gateway protocol’s internal/pkg/table/message.go file is related to unvalidated array indexing. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the parseRibEntry() function in the pkg/packet/mrt/mrt.go file of the GoBGP edge router protocol allows a attacker to cause a service failure.

The vulnerability of the parseRibEntry function in the pkg/packet/mrt/mrt.go file of the GoBGP firewall protocol is related to the possibility of integer overflow. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

The vulnerability of the AdjRib.Update() function in the control module for the Adj-RIB BGP protocol of the GoBGP border gateway allows a attacker to cause a service failure.

The vulnerability of the AdjRib.Update function in the Adj-RIB BGP protocol control module of the GoBGP border gateway is related to the handling of the zero pointer. Exploiting this vulnerability could allow a malicious actor to cause service failure...

The vulnerability of the DecodeFromBytes() function in the pkg/packet/bgp/prefix_sid.go file of the SRv6 L3 Service protocol for the border gateway GoBGP allows a attacker to cause a service failure.

The vulnerability of the DecodeFromBytes function in the pkg/packet/bgp/prefixsid.go file of the SRv6 L3 Service protocol for the GoBGP edge gateway is related to improper resource cleanup or release. Exploiting this vulnerability could allow a malicious actor to cause service failure...

The vulnerability of the DecodeFromBytes() function in the pkg/packet/bgp/bgp.go file of the AIGP Attribute Parser component of the GoBGP border gateway protocol allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the DecodeFromBytes function in the pkg/packet/bgp/bgp.go file of the AIGP Attribute Parser component of the GoBGP border gateway protocol is related to the operation of pushing data out of the buffer into memory. Exploiting this vulnerability could allow a malicious actor to...

The vulnerability of the DecodeFromBytes() function in the pkg/packet/bgp/bgp.go file of the BGP Header Handler component of the GoBGP border gateway protocol allows a attacker to increase their privileges.

The vulnerability of the DecodeFromBytes function in the pkg/packet/bgp/bgp.go file of the BGP Header Handler component of the GoBGP border gateway protocol is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

The vulnerability of the ParseIP6Extended() function in the bgp/bgp.go file of the GoBGP border gateway protocol allows a attacker to cause a service failure.

The vulnerability of the ParseIP6Extended function in the bgp/bgp.go file of the GoBGP border gateway protocol is related to the issue of operations going beyond the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the ParseBody() function in the pkg/packet/bmp/bmp.go file of the BMP Parser component of the GoBGP edge gateway protocol allows a attacker to cause a service failure.

The vulnerability of the ParseBody function in the pkg/packet/bmp/bmp.go file of the BMP Parser component of the GoBGP edge gateway protocol is related to the situation where the output of the operation goes beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a...

The vulnerability of the BGP OPEN message parser in the pkg/packet/bbg module of the edge gateway protocol GoBGP allows a attacker to compromise the integrity of the protected information.

The vulnerability of the BGP OPEN message parser in the pkg/packet/bbg module of the edge gateway protocol GoBGP is related to the execution of operations beyond the buffer boundaries. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of the protected...

CVE-2026-49838

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP...

CVE-2026-49837

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded b...

CVE-2026-49838

GoBGP , an open-source BGP implementation in Go, is vulnerable to a denial-of-service in its BGP UPDATE validator prior to version 4.7.0 . When a confederation eBGP peer sends a malformed UPDATE containing a zero-length AS_PATH , the attribute passes initial decoding but triggers an unchecked p.V...

EUVD-2026-75807

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP...

CVE-2026-49838 GoBGP confederation validation panics on empty AS_PATH attribute

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP...

CVE-2026-49838 GoBGP confederation validation panics on empty AS_PATH attribute

GoBGP is an open source Border Gateway Protocol BGP implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length ASPATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP...