CVE-2026-49838

Name of the Vulnerable Software and Affected Versions gobgp (affected versions not specified)

Description GoBGP fails to properly handle BGP UPDATE messages containing a zero-length AS PATH attribute. When a configured confederation eBGP peer sends a malformed UPDATE with a syntactically valid AS PATH header but zero value length, the decoder does not report it as a malformed attribute. Subsequently, the ValidateAttribute() function attempts to access the first element of the empty p.Value slice, leading to an index out of range panic. This allows a remote unauthenticated peer configured as a confederation eBGP neighbor to trigger a denial of service, potentially terminating the process or the peer session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.