Summary
GoBGP confederation validation panics on empty AS_PATH attribute
Full technical description
Found through variant analysis based on CVE-2026-41643
GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked p.Value[0] access, allowing a configured confederation eBGP peer to trigger a denial of service.
Affected
- Project: gobgp
- Repo: https://github.com/osrg/gobgp
- Pinned ref: c24629411ba49f160d9dc09126f418218127e016
Root cause
An established peer's receive path reads BGP bytes from the network connection in pkg/server/fsm.go:1267, parses UPDATE bodies through the BGP message decoder, and validates decoded UPDATEs with peer state at pkg/server/fsm.go:1849. The UPDATE decoder walks the path-attribute list in pkg/packet/bgp/bgp.go:15773 and selects the concrete attribute parser from the attacker-controlled attribute type at pkg/packet/bgp/bgp.go:15855. For AS_PATH, PathAttributeAsPath.DecodeFromBytes returns nil when the decoded attribute length is zero (pkg/packet/bgp/bgp.go:11533, pkg/packet/bgp/bgp.go:11538), leaving p.Value empty rather than reporting a malformed attribute. Validation then dispatches each decoded attribute through ValidateAttribute (pkg/packet/bgp/validate.go:34); in the confederation eBGP branch, pkg/packet/bgp/validate.go:162 indexes p.Value[0] before checking that any AS_PATH segment was decoded. The eBGP and confederation guards are normal peer-state gates: pkg/config/oc/util.go:127 defines eBGP as peer AS differing from local AS, pkg/config/oc/util.go:116 checks confederation membership, and pkg/server/fsm.go:740 and pkg/server/fsm.go:741 copy those results into the FSM state used by the validator.
Reproduction
INT-bgp-gobgp-confed-empty-aspath-panic.zip
bash ./poc/run.sh
TRIGGERED: confed empty AS_PATH validation panic: runtime error: index out of range
The TRIGGERED line is the recovered panic fingerprint from the confederation eBGP validation path after a zero-length AS_PATH has decoded successfully. A build failure or any output without that fingerprint would not demonstrate this bug, because the signal is tied to the unchecked AS_PATH segment access.
Resources
Impact
A remote unauthenticated peer that is configured as a confederation eBGP neighbor can establish a BGP session and send a single malformed UPDATE containing a syntactically valid AS_PATH attribute header with zero value length. Because the decode path does not turn that empty AS_PATH into a MessageError, normal malformed-attribute handling is bypassed and validation panics before GoBGP can return a BGP NOTIFICATION. The demonstrated effect is denial of service for the receive goroutine and peer session, with potential process termination if the panic is not recovered by the runtime path; no memory corruption, data disclosure, authentication bypass, or code execution is claimed.
CVE-2026-49838 has a CVSS score of 5.9 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.7.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
diff --git a/pkg/packet/bgp/validate.go b/pkg/packet/bgp/validate.go
index 2237afb..f07f4fa 100644
--- a/pkg/packet/bgp/validate.go
+++ b/pkg/packet/bgp/validate.go
@@ -159,6 +159,9 @@ func ValidateAttribute(a PathAttributeInterface, rfs map[Family]BGPAddPathMode,
case *PathAttributeAsPath:
if isEBGP {
if isConfed {
+ if len(p.Value) == 0 {
+ return false, NewMessageError(eCode, eSubCodeMalformedAspath, nil, "empty AS_PATH for confederation eBGP")
+ }
if segType := p.Value[0].GetType(); segType != BGP_ASPATH_ATTR_TYPE_CONFED_SEQ {
return false, NewMessageError(eCode, eSubCodeMalformedAspath, nil, fmt.Sprintf("segment type is not confederation seq (%d)", segType))
}
Frequently Asked Questions
- What is CVE-2026-49838? CVE-2026-49838 is a medium-severity security vulnerability in github.com/osrg/gobgp/v4 (go), affecting versions <= 4.6.0. It is fixed in 4.7.0.
- How severe is CVE-2026-49838? CVE-2026-49838 has a CVSS score of 5.9 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/osrg/gobgp/v4 are affected by CVE-2026-49838? github.com/osrg/gobgp/v4 (go) versions <= 4.6.0 is affected.
- Is there a fix for CVE-2026-49838? Yes. CVE-2026-49838 is fixed in 4.7.0. Upgrade to this version or later.
- Is CVE-2026-49838 exploitable, and should I be worried? Whether CVE-2026-49838 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-49838 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-49838? Upgrade
github.com/osrg/gobgp/v4to 4.7.0 or later.