CVE-2026-5122: 
NixOS vulnerability analysis and mitigation

CVE-2026-5122 is an improper access control vulnerability in osrg GoBGP, a BGP implementation written in Go, affecting all versions up to and including 4.3.0. The flaw resides in the DecodeFromBytes function within pkg/packet/bgp/bgp.go, specifically in the CapFQDN (FQDN capability) handler of the BGP OPEN Message processing component. By manipulating the domainNameLen argument, a remote attacker can cause the parser to read beyond the intended boundary, incorporating unrelated trailing data into the parsed domain name. The vulnerability was disclosed on March 30, 2026, with a patch merged on March 12, 2026. It carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (Github Advisory, GoBGP PR #3343).

The root cause is classified under CWE-266 (Incorrect Privilege Assignment) and CWE-284 (Improper Access Control). Specifically, the CapFQDN.DecodeFromBytes function in bgp.go parsed the DomainName field using all remaining bytes in the buffer (data[hostNameLen+2:]) rather than respecting the declared DomainNameLen field, which should have bounded the slice to data[hostNameLen+2 : hostNameLen+2+int(domainNameLen)] (GoBGP Commit). This means a crafted BGP OPEN message with trailing bytes appended after the FQDN capability data could cause the parser to include those extraneous bytes in the DomainName field. The attack is network-initiated, requires no authentication or user interaction, but is rated high complexity, as the attacker must establish or intercept a BGP session to deliver the malicious OPEN message (Github Advisory).

Successful exploitation results in a low-integrity impact: an attacker can manipulate the parsed DomainName value within BGP OPEN message handling, potentially causing GoBGP to process or log incorrect routing peer identity information. There is no confidentiality or availability impact — the vulnerability does not enable code execution, data exfiltration, or service disruption. The practical risk is limited to BGP message data integrity within the affected GoBGP instance, which could affect peer identification or logging accuracy in routing infrastructure (Github Advisory, GoBGP PR #3343).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.033–0.062%, placing it in a low percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. The high attack complexity — requiring the attacker to participate in a BGP session — significantly limits the practical exploitability of this flaw.

1. Reconnaissance: Identify GoBGP instances (versions ≤ 4.3.0) exposed on BGP port 179/TCP using network scanning tools such as Shodan, Censys, or Masscan.
2. Establish BGP session: Initiate a BGP TCP connection to the target on port 179. BGP OPEN messages are exchanged at session establishment, so the attacker must either be a legitimate or spoofed BGP peer.
3. Craft malicious BGP OPEN message: Construct a BGP OPEN message containing the FQDN capability (Capability Code 73) with a valid HostNameLen and DomainNameLen field, but append additional arbitrary bytes after the declared DomainNameLen boundary within the capability data.
4. Trigger vulnerable parsing: Send the crafted OPEN message to the target GoBGP instance. The vulnerable CapFQDN.DecodeFromBytes function will read beyond DomainNameLen, incorporating the trailing bytes into the parsed DomainName field.
5. Observe impact: The attacker's controlled bytes are now part of the peer's parsed domain name in GoBGP's internal state, potentially affecting peer identification, logging, or any downstream logic that consumes the DomainName value (GoBGP Commit, GoBGP PR #3343).

• Network: Unexpected or unauthorized BGP session establishment attempts on TCP port 179 from unknown peers; BGP OPEN messages with anomalous FQDN capability data lengths detectable via packet inspection.
• Logs: GoBGP logs recording peer domain names containing non-printable characters, binary garbage, or unexpectedly long strings in FQDN capability fields; mismatches between declared DomainNameLen and the length of the logged domain name.
• Process/Application: GoBGP internal state showing peer DomainName values that do not correspond to valid DNS names or contain trailing binary data.

Upgrade GoBGP to version 4.4.0 or later, which includes the fix introduced in commit 2b09db390a3d455808363c53e409afe6b1b86d2d (GoBGP Commit, GoBGP PR #3343). As a temporary workaround if immediate patching is not possible, implement network-level access controls (e.g., firewall rules, BGP MD5 authentication, or TCP-AO) to restrict BGP session establishment to only trusted, known peers, thereby reducing the attack surface. Monitor BGP logs for anomalous FQDN capability data as described in the IOCs section.