CVE-2026-49838: GoBGP confederation validation panics on empty AS_PATH attribute

July 9, 2026

GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked p.Value[0] access, allowing a configured confederation eBGP peer to trigger a denial of service.

References

github.com/advisories/GHSA-frrj-87jh-2772
github.com/osrg/gobgp/security/advisories/GHSA-frrj-87jh-2772
nvd.nist.gov/vuln/detail/CVE-2026-49838

Code Behaviors & Features

Detect and mitigate CVE-2026-49838 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →