CVE-2026-5124: 
NixOS vulnerability analysis and mitigation

CVE-2026-5124 is an improper access control vulnerability in osrg GoBGP, an open-source BGP implementation written in Go. It affects the BGPHeader.DecodeFromBytes function in pkg/packet/bgp/bgp.go, specifically the BGP Header Handler component, in all versions up to and including 4.3.0. The vulnerability stems from missing validation of the 16-byte Marker field in BGP message headers, which RFC 4271 Section 6.1 requires to be all 0xFF. It was disclosed on March 30, 2026, with a patch merged on March 12, 2026. The CVSS v3.1 base score is 3.7 (Low), while the CVSS v4.0 base score is 6.3 (Medium) (Github Advisory, Feedly).

The root cause is classified under CWE-266 (Incorrect Privilege Assignment) and CWE-284 (Improper Access Control). Prior to the fix, BGPHeader.DecodeFromBytes in pkg/packet/bgp/bgp.go did not verify that the 16-byte Marker field of incoming BGP messages was set to all 0xFF bytes, as mandated by RFC 4271 Section 6.1. An unauthenticated remote attacker could send a crafted BGP message with an invalid Marker field, bypassing the expected header validation logic. The fix (commit f0f24a2) adds a check using binary.BigEndian.Uint64 on both 8-byte halves of the Marker field, returning a BGP_ERROR_MESSAGE_HEADER_ERROR / BGP_ERROR_SUB_CONNECTION_NOT_SYNCHRONIZED notification if the check fails (GoBGP PR #3340, Patch Commit).

Successful exploitation results in a low-severity integrity impact on the vulnerable system, with no confidentiality or availability impact. An attacker could manipulate BGP header processing by injecting messages with invalid Marker fields that are accepted rather than rejected, potentially influencing BGP session behavior or routing data integrity. The scope is limited to the vulnerable GoBGP instance itself, with no demonstrated impact on subsequent systems (Github Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Feedly). The attack requires high complexity, is network-based, and requires no authentication or user interaction, but the difficulty of exploitation is rated as high. The EPSS score is approximately 0.033–0.062%, placing it in a low percentile for near-term exploitation likelihood. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Reconnaissance: Identify hosts running GoBGP versions up to 4.3.0 that are reachable over TCP port 179 (BGP). Tools such as Shodan or Censys can be used to locate internet-facing BGP speakers.
2. Establish or spoof a BGP connection: Initiate a TCP connection to port 179 on the target GoBGP instance. BGP sessions typically require a TCP handshake before message exchange.
3. Craft a malformed BGP message: Construct a BGP message where the 16-byte Marker field is not all 0xFF (e.g., set some bytes to 0x00). Prior to the patch, GoBGP's BGPHeader.DecodeFromBytes would not reject such a message.
4. Send the crafted message: Transmit the malformed BGP message to the target. The unpatched GoBGP instance would process the message without raising a Connection Not Synchronized error, potentially allowing manipulation of BGP session state or routing data integrity.
5. Observe impact: Monitor for unexpected BGP session behavior or routing table modifications resulting from the accepted invalid message (GoBGP PR #3340, Patch Commit).

• Network: Unexpected inbound TCP connections to port 179 from untrusted or unknown IP addresses; BGP messages with Marker fields not set to all 0xFF bytes captured in packet captures.
• Logs: GoBGP logs showing BGP sessions established or messages processed from unexpected peers without a corresponding Connection Not Synchronized error; absence of BGP_ERROR_SUB_CONNECTION_NOT_SYNCHRONIZED errors on unpatched instances receiving malformed headers.
• Process: Unusual BGP session state changes or routing table modifications not correlated with legitimate peer activity on the GoBGP process.

The fix is available in GoBGP version 4.4.0 and later, introduced via commit f0f24a2a901cbf159260698211ab15c583ced131 merged in PR #3340 on March 12, 2026. Organizations running GoBGP 4.0, 4.1, 4.2, or 4.3.0 should upgrade to version 4.4.0 or newer as the primary remediation. As a temporary workaround where immediate patching is not possible, restrict network-level access to BGP port 179 using firewall rules or ACLs to limit exposure to trusted BGP peers only (GoBGP PR #3340, Github Advisory).

The vulnerability was assigned by VulDB and published to the GitHub Advisory Database on March 30, 2026. The CVEnew Twitter/X account posted about the CVE shortly after disclosure. No significant independent researcher commentary, vendor statements beyond the patch, or notable media coverage has been identified for this vulnerability (Feedly).