CyberRota Analysis
AI-GeneratedGoBGP versions prior to 4.6.0 are vulnerable to a parsing issue in the BGP OPEN capability, which can lead to incorrect interpretation of capability lengths, particularly affecting the 4-octet AS capability. This vulnerability may allow malformed BGP OPEN messages to compromise peer AS validation during session establishment, potentially leading to routing misconfigurations or attacks. Network operators using affected versions should prioritize upgrading to version 4.6.0 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`. A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment. Version 4.6.0 patches the issue.