CVE-2026-49838: 
Wolfi vulnerability analysis and mitigation

CVE-2026-49838 is a denial-of-service vulnerability in GoBGP (the open-source BGP implementation in Go) where a zero-length AS_PATH attribute in a BGP UPDATE message causes a runtime panic during confederation eBGP peer validation. It affects all versions of github.com/osrg/gobgp/v4 up to and including v4.6.0, with v4.7.0 containing the fix. The vulnerability was discovered through variant analysis based on CVE-2026-41643, published on June 30, 2026, and added to the GitHub Advisory Database on July 9, 2026. It carries a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, GoBGP Advisory).

The root cause is an improper validation of an array index (CWE-129) in pkg/packet/bgp/validate.go. When PathAttributeAsPath.DecodeFromBytes receives an AS_PATH attribute with zero value length, it returns nil without populating p.Value and without raising a MessageError — effectively treating an empty AS_PATH as valid (see bgp.go:11533–11538). Downstream, the ValidateAttribute function's confederation eBGP branch at validate.go:162 unconditionally accesses p.Value[0] before checking whether any AS_PATH segments were decoded, triggering a Go runtime panic (index out of range). Exploitation requires an established BGP session with a peer configured as a confederation eBGP neighbor; the attacker then sends a single crafted UPDATE message with a syntactically valid AS_PATH attribute header but zero value length (GitHub Advisory, GoBGP Advisory).

Successful exploitation causes a panic in GoBGP's receive goroutine, terminating the affected peer session and potentially crashing the entire GoBGP process if the panic is not recovered by the runtime. The impact is limited to availability — there is no memory corruption, data disclosure, authentication bypass, or code execution. Operators relying on GoBGP for BGP routing in confederation deployments could experience routing disruptions or complete loss of BGP peering sessions (GitHub Advisory).

A proof-of-concept (INT-bgp-gobgp-confed-empty-aspath-panic.zip) was included in the security advisory and demonstrates reliable triggering of the panic with a single malformed UPDATE message. Exploitation requires the attacker to be a configured confederation eBGP neighbor — meaning a BGP session must already be established — which raises the attack complexity. There is no evidence of in-the-wild exploitation, no known threat actor attribution, and the CVE is not listed in the CISA KEV catalog as of the time of this report (GitHub Advisory, GoBGP Advisory).

1. Establish a BGP session: The attacker must be configured as a confederation eBGP neighbor on the target GoBGP instance. This requires either being a legitimate peer or having compromised a peer's credentials/network position.
2. Craft a malformed UPDATE message: Construct a BGP UPDATE message containing an AS_PATH path attribute with a valid attribute header (type code 2, correct flags) but with the attribute length field set to zero, resulting in an empty value field.
3. Send the malformed UPDATE: Transmit the crafted UPDATE over the established BGP TCP session (port 179) to the target GoBGP instance.
4. Trigger the panic: GoBGP's decoder accepts the zero-length AS_PATH without error; the validator then attempts to access p.Value[0] in the confederation eBGP branch, causing a Go runtime panic (index out of range) that crashes the receive goroutine and terminates the peer session or the process (GitHub Advisory, GoBGP Advisory).

• Logs: GoBGP process logs containing Go runtime panic messages such as runtime error: index out of range originating from pkg/packet/bgp/validate.go around line 162; unexpected peer session resets or BGP NOTIFICATION absence where one would be expected for a malformed UPDATE.
• Network: A single BGP UPDATE message (TCP port 179) from a confederation eBGP peer containing an AS_PATH attribute (type 2) with a zero-length value field; absence of a BGP NOTIFICATION response from GoBGP following receipt of such a message.
• Process: Unexpected termination or restart of the GoBGP process; goroutine crash stack traces in system logs referencing fsm.go and validate.go (GitHub Advisory).

Upgrade to GoBGP v4.7.0, which includes the fix adding a bounds check (if len(p.Value) == 0) before the p.Value[0] access in pkg/packet/bgp/validate.go, returning a proper MessageError for empty AS_PATH in confederation eBGP context. No configuration-based workaround is available; the only mitigation short of patching is to avoid configuring confederation eBGP peers on untrusted or potentially adversarial BGP neighbors. The fix commit is available at 4a319a6c25630fb3cdbda3e9ccfe56e702bdaaa0 (GitHub Advisory, GoBGP Advisory).