CVE-2026-49837

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.

• CWE-125

• https://github.com/osrg/gobgp/commit/f02ca397821f6ca182ef4eb492c3cbc459552d7c
• https://github.com/osrg/gobgp/security/advisories/GHSA-gjrg-jjr3-56cm

Published

Sep 10, 2026

Last Modified

Sep 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49831DSpace open source software is a repository application whic…5.5
• CVE-2026-49832DSpace open source software is a repository application whic…8
• CVE-2026-49833DSpace open source software is a repository application whic…5.5
• CVE-2026-49834sigstore-go is a Go library for Sigstore signing and verific…7.5
• CVE-2026-49835Sigstore Timestamp Authority is a service for issuing RFC 31…7.5
• CVE-2026-49836psd-tools is a Python package for working with Adobe Photosh…4.6
• CVE-2026-49838GoBGP is an open source Border Gateway Protocol (BGP) implem…5.9
• CVE-2026-49839jq is a command-line JSON processor. Prior to 1.8.2,` jq --r…7.1
• CVE-2026-4984The Twilio integration webhook handler accepts any POST requ…8.2
• CVE-2026-49840FreeSWITCH is a Software Defined Telecom Stack enabling the …9.1
• CVE-2026-49841FreeSWITCH is a Software Defined Telecom Stack enabling the …9.8
• CVE-2026-49842FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5