CVE-2026-49837: GoBGP BGP OPEN Capability Parser May Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-gjrg-jjr3-56cm",
  "modified" : "2026-07-09T23:20:57Z",
  "published" : "2026-07-09T23:20:57Z",
  "aliases" : [ "CVE-2026-49837" ],
  "summary" : "GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries",
  "details" : "### Summary\n    GoBGP contains a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`.\n    A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment.\n\n### Details\nThe issue is in the BGP OPEN capability parser under:\n\n- `pkg/packet/bgp/bgp.go`\n- `pkg/packet/bgp/validate.go`\n- \nThe BGP OPEN optional parameter capability format includes a capability code, a capability length field, and a capability value. Each concrete capability decoder should only parse bytes inside the declared capability value boundary.\nIn affected versions, the generic capability parser records the declared `CapLen`, but several concrete capability decoders continue parsing from the full remaining capability buffer after advancing past the two-byte capability header. Conceptually, the vulnerable pattern is:\n```go\ndata = data[2:]\n// decoder reads from data without first limiting it to CapLen\n\n### PoC\nThe following parser-level proof of concept demonstrates the issue without requiring a full BGP session or a running `bgpd` instance.\nThe malformed capability uses:\n- Capability Code: `65` (`BGP_CAP_FOUR_OCTET_AS_NUMBER`)\n- Declared `CapLen`: `0`\n- Four following bytes: `00 00 fd e8`\n\nAlthough the capability declares an empty value, affected versions parse the following four bytes as the 4-octet AS value `65000`.\n\n### Impact\nA remote peer that can send a malformed BGP OPEN message to a GoBGP instance may cause capability values to be parsed from outside their declared `CapLen` boundaries.\nIn the 4-octet AS capability case, this may affect:\n- peer AS validation;\n- capability negotiation;\n- interpretation of malformed OPEN messages;\n- acceptance or rejection decisions during BGP session establishment.\nThis issue does not appear to be arbitrary memory corruption, remote code execution, or information disclosure. It is a protocol parser boundary validation issue that can affect BGP OPEN validation semantics.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/osrg/gobgp/v4"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.6.0"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 4.5.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/osrg/gobgp/security/advisories/GHSA-gjrg-jjr3-56cm"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/osrg/gobgp"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-09T23:20:57Z",
    "nvd_published_at" : null
  }
}