CVE-2026-49837: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-49837 is a BGP OPEN capability parsing boundary violation in GoBGP, an open-source BGP implementation written in Go. Versions up to and including 4.5.0 are affected; version 4.6.0 contains the fix. The flaw allows a remote peer to send a malformed BGP OPEN message that causes capability decoders to read bytes beyond the declared CapLen boundary, potentially corrupting peer AS validation during session establishment. It carries a CVSS v3.1 base score of 5.9 (Medium) (Github Advisory, Feedly). The advisory was first published on June 2, 2026, and added to the GitHub Advisory Database on July 9, 2026 (Github Advisory).

The root cause is an out-of-bounds read (CWE-125) in the BGP OPEN capability parser located in pkg/packet/bgp/bgp.go and pkg/packet/bgp/validate.go. After the generic DefaultParameterCapability.DecodeFromBytes records the declared CapLen, several concrete decoders — including CapFourOctetASNumber, CapMultiProtocol, CapGracefulRestart, CapFQDN, and CapSoftwareVersion — advance past the two-byte capability header with data = data[2:] but then read from the full remaining buffer rather than the CapLen-bounded slice (Github Advisory). The most security-relevant case involves CapFourOctetASNumber: a crafted capability with CapLen == 0 causes the parser to read the four bytes of the following capability as the 4-octet AS number, which then flows into ValidateOpenMsg for peer AS validation (GoBGP Commit). A parser-level proof-of-concept is included in the advisory, using capability code 65, CapLen = 0, and trailing bytes 00 00 fd e8 (AS 65000) to demonstrate the misread without requiring a live BGP session (Github Advisory).

Successful exploitation affects the integrity of BGP session establishment: a remote peer can manipulate the AS number parsed from a malformed OPEN message, potentially causing incorrect peer AS validation, flawed capability negotiation, and erroneous acceptance or rejection of BGP sessions (Github Advisory). The advisory explicitly states this is not arbitrary memory corruption, remote code execution, or information disclosure — it is a protocol parser boundary issue confined to BGP OPEN validation semantics (Github Advisory). In network environments relying on GoBGP for routing policy enforcement, manipulation of AS validation could disrupt routing decisions or allow unauthorized BGP session establishment (Red Hat Bugzilla).

No in-the-wild exploitation has been reported, and no weaponized exploit kits are known to leverage this vulnerability (Feedly). A parser-level proof-of-concept is publicly documented in the GitHub security advisory, demonstrating the boundary misread without requiring a full BGP session (Github Advisory). The EPSS score is approximately 0.255% (17th percentile), indicating a low near-term exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory). Exploitation requires high attack complexity, as the attacker must be able to establish or attempt a BGP OPEN exchange with the target GoBGP instance (Feedly).

1. Reconnaissance: Identify GoBGP instances (versions ≤ 4.5.0) exposed on TCP port 179 using network scanning tools such as Nmap or Shodan, targeting environments where BGP peering is accessible.
2. Initiate BGP session: Establish a TCP connection to port 179 on the target GoBGP instance, as BGP OPEN messages are exchanged at the start of session setup.
3. Craft malformed BGP OPEN message: Construct a BGP OPEN message containing a malformed capability TLV with:
   • Capability Code: 0x41 (65, BGP_CAP_FOUR_OCTET_AS_NUMBER)
   • Declared CapLen: 0x00 (zero)
   • Immediately following bytes: 00 00 fd e8 (representing AS 65000 in big-endian)
4. Send the malformed OPEN: Transmit the crafted BGP OPEN message to the target. The vulnerable parser reads the four bytes following the zero-length capability as the 4-octet AS value.
5. Trigger AS validation manipulation: The misread AS value (e.g., 65000) flows into ValidateOpenMsg, potentially causing the GoBGP instance to accept or reject the BGP session based on the attacker-controlled AS number rather than the legitimately declared one (Github Advisory, GoBGP Commit).

• Network: Unexpected or malformed BGP OPEN messages on TCP port 179 with capability TLVs where CapLen is 0 or inconsistent with the capability type's required size; BGP session establishment attempts from unexpected peers or IP addresses.
• Logs: GoBGP logs showing BGP OPEN message parsing errors or unexpected AS numbers during session negotiation; repeated failed or anomalous BGP session establishment attempts from the same source.
• Process/Application: GoBGP instances accepting or rejecting BGP sessions with peer AS values that do not match configured neighbor AS numbers, potentially indicating manipulated AS validation outcomes (Github Advisory).

Upgrade GoBGP to version 4.6.0, which enforces CapLen boundary checks in all affected capability decoders (CapFourOctetASNumber, CapMultiProtocol, CapGracefulRestart, CapFQDN, CapSoftwareVersion) and rejects any capability with a CapLen that does not match the required size (GoBGP Commit, Github Advisory). No configuration-based workaround is documented; upgrading to 4.6.0 is the only recommended remediation. As an interim network-level measure, restrict BGP peering (TCP port 179) to known, trusted peer IP addresses using firewall rules or BGP MD5 authentication to reduce the attack surface.

Red Hat opened a high-severity bug tracking entry (Bug 2531682) for this CVE, indicating it is being assessed for impact on Red Hat products that may include GoBGP as a dependency (Red Hat Bugzilla). The openSUSE security announcement list also referenced the vulnerability in the context of govulncheck/vulndb updates (openSUSE). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.