{"id":"GHSA-gjrg-jjr3-56cm","summary":"GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries","details":"### Summary\n    GoBGP contains a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`.\n    A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment.\n\n### Details\nThe issue is in the BGP OPEN capability parser under:\n\n- `pkg/packet/bgp/bgp.go`\n- `pkg/packet/bgp/validate.go`\n- \nThe BGP OPEN optional parameter capability format includes a capability code, a capability length field, and a capability value. Each concrete capability decoder should only parse bytes inside the declared capability value boundary.\nIn affected versions, the generic capability parser records the declared `CapLen`, but several concrete capability decoders continue parsing from the full remaining capability buffer after advancing past the two-byte capability header. Conceptually, the vulnerable pattern is:\n```go\ndata = data[2:]\n// decoder reads from data without first limiting it to CapLen\n\n### PoC\nThe following parser-level proof of concept demonstrates the issue without requiring a full BGP session or a running `bgpd` instance.\nThe malformed capability uses:\n- Capability Code: `65` (`BGP_CAP_FOUR_OCTET_AS_NUMBER`)\n- Declared `CapLen`: `0`\n- Four following bytes: `00 00 fd e8`\n\nAlthough the capability declares an empty value, affected versions parse the following four bytes as the 4-octet AS value `65000`.\n\n### Impact\nA remote peer that can send a malformed BGP OPEN message to a GoBGP instance may cause capability values to be parsed from outside their declared `CapLen` boundaries.\nIn the 4-octet AS capability case, this may affect:\n- peer AS validation;\n- capability negotiation;\n- interpretation of malformed OPEN messages;\n- acceptance or rejection decisions during BGP session establishment.\nThis issue does not appear to be arbitrary memory corruption, remote code execution, or information disclosure. It is a protocol parser boundary validation issue that can affect BGP OPEN validation semantics.","aliases":["CVE-2026-49837","GO-2026-5955"],"modified":"2026-07-24T19:26:32.248210046Z","published":"2026-07-09T23:20:57Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-07-09T23:20:57Z","nvd_published_at":null,"cwe_ids":["CWE-125"],"severity":"MODERATE"},"references":[{"type":"WEB","url":"https://github.com/osrg/gobgp/security/advisories/GHSA-gjrg-jjr3-56cm"},{"type":"PACKAGE","url":"https://github.com/osrg/gobgp"}],"affected":[{"package":{"name":"github.com/osrg/gobgp/v4","ecosystem":"Go","purl":"pkg:golang/github.com/osrg/gobgp/v4"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.6.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-gjrg-jjr3-56cm/GHSA-gjrg-jjr3-56cm.json","last_known_affected_version_range":"\u003c= 4.5.0"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}