CVE-2026-5123: GoBGP Buffer Overflow Vulnerability

CVE-2026-5123 Overview

A vulnerability has been identified in osrg GoBGP versions up to 4.3.0 affecting the DecodeFromBytes function within the file pkg/packet/bgp/bgp.go. This off-by-one error occurs when processing the data[1] argument, potentially allowing remote attackers to trigger memory boundary issues. The vulnerability is classified as highly complex with difficult exploitability characteristics, requiring network access but no user interaction or privileges.

Critical Impact
Remote attackers could potentially exploit this off-by-one vulnerability to cause memory access violations in BGP packet processing, potentially impacting network routing infrastructure stability.

Affected Products

osrg GoBGP versions up to 4.3.0
Systems running vulnerable GoBGP deployments for BGP routing
Network infrastructure utilizing GoBGP for BGP protocol handling

Discovery Timeline

2026-03-30 - CVE-2026-5123 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-5123

Vulnerability Analysis

This vulnerability stems from an off-by-one error in the CapSoftwareVersion.DecodeFromBytes function within GoBGP's BGP packet processing code. The flaw exists in how the software version capability is decoded from incoming BGP OPEN messages. When extracting the software version string from packet data, the code incorrectly calculates the slice boundaries, leading to an off-by-one condition.

The vulnerability affects the BGP OPEN message capability negotiation phase, where peers exchange software version information. While exploitation requires network access to send crafted BGP packets, the attack complexity is considered high due to the specific conditions needed to trigger the boundary error.

Root Cause

The root cause lies in improper boundary calculation when slicing the data buffer to extract the software version string. The original code used data[1:c.SoftwareVersionLen] which incorrectly calculates the end position of the slice. This off-by-one error occurs because the slice should account for the starting offset of 1 when determining the ending boundary, requiring data[1:1+c.SoftwareVersionLen] to correctly extract the intended data range.

Attack Vector

The attack vector is network-based, requiring an attacker to send specially crafted BGP OPEN messages to a vulnerable GoBGP instance. The attacker would need to manipulate the software version capability field within the BGP OPEN message to trigger the off-by-one condition. Given the high attack complexity, successful exploitation would likely require:

Network connectivity to the BGP daemon
Knowledge of the specific packet structure
Ability to bypass any existing network security controls

The following patch addresses the vulnerability by correcting the slice boundary calculation:

 		return NewMessageError(BGP_ERROR_OPEN_MESSAGE_ERROR, BGP_ERROR_SUB_UNSUPPORTED_CAPABILITY, nil, "invalid length of software version capablity")
 	}
 	c.SoftwareVersionLen = softwareVersionLen
-	c.SoftwareVersion = string(data[1:c.SoftwareVersionLen])
+	c.SoftwareVersion = string(data[1 : 1+c.SoftwareVersionLen])
 	return nil
 }

Source: GitHub Commit Details

Detection Methods for CVE-2026-5123

Indicators of Compromise

Unexpected BGP session resets or connection failures
Malformed BGP OPEN messages in packet captures containing unusual software version capability lengths
BGP daemon crashes or unexpected restarts without configuration changes
Anomalous network traffic patterns targeting BGP port 179

Detection Strategies

Implement network intrusion detection rules to identify malformed BGP OPEN messages with suspicious software version capability fields
Monitor GoBGP process logs for BGP_ERROR_OPEN_MESSAGE_ERROR or BGP_ERROR_SUB_UNSUPPORTED_CAPABILITY error messages
Deploy packet inspection at network boundaries to analyze BGP traffic for anomalous capability lengths
Use application-level logging to track BGP session establishment failures

Monitoring Recommendations

Enable verbose logging on GoBGP instances to capture detailed BGP message processing information
Implement real-time alerting for BGP session anomalies and unexpected peer disconnections
Monitor system resource utilization on GoBGP hosts for signs of denial of service conditions
Review BGP session logs regularly for patterns of malformed message attempts

How to Mitigate CVE-2026-5123

Immediate Actions Required

Upgrade GoBGP to the patched version containing commit 67c059413470df64bc20801c46f64058e88f800f
Review network access controls to limit BGP peer connections to trusted sources only
Implement network segmentation to isolate BGP infrastructure from untrusted networks
Enable BGP authentication mechanisms such as TCP MD5 signatures to prevent unauthorized peer connections

Patch Information

A security patch has been released by the osrg GoBGP project. The fix is contained in commit 67c059413470df64bc20801c46f64058e88f800f. Organizations should update their GoBGP deployments by pulling the latest version from the GoBGP GitHub Repository or applying the specific patch from the GitHub Pull Request #3342.

Workarounds

Restrict BGP peer connections to only known and trusted IP addresses using firewall rules
Implement strict input validation at the network perimeter for BGP traffic
Consider deploying a BGP-aware firewall or intrusion prevention system to filter malformed packets
Use BGP prefix filtering and peer authentication to reduce the attack surface

bash

# Configuration example - Restrict BGP connections using iptables
# Allow BGP from trusted peer IP only
iptables -A INPUT -p tcp --dport 179 -s <trusted_peer_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 179 -j DROP

# Verify GoBGP version and check for updates
gobgp version