Most recent entries from all

bdu:2026-14523

CLEANSTART-2026-HU02561 — Security fix for CVE-2026-49838 applied in: kube-vip 1.2.1-r0

Affected: CleanStart: kube-vip

Security vulnerability affects the kube-vip package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-367101

fkie_cve-2026-49838

GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service. Version 4.7.0 patches the issue.

GHSA-frrj-87jh-2772 — GoBGP confederation validation panics on empty AS_PATH attribute

Affected: Go: github.com/osrg/gobgp/v4

Found through variant analysis based on `CVE-2026-41643`

## Summary GoBGP accepts a zero-length AS_PATH during UPDATE decoding and later panics while validating that attribute for a confederation eBGP peer. The vulnerable path is in the BGP UPDATE validator: a malformed UPDATE that should be rejected as a malformed AS_PATH instead reaches an unchecked `p.Value[0]` access, allowing a configured confederation eBGP peer to trigger a denial of service.

## Affected - Project: gobgp - Repo: https://github.com/osrg/gobgp - Pinned ref: c24629411ba49f160d9dc09126f418218127e016

## Root cause An established peer's receive path reads BGP bytes from the network connection in `pkg/server/fsm.go:1267`, parses UPDATE bodies through the BGP message decoder, and validates decoded UPDATEs with peer state at `pkg/server/fsm.go:1849`. The UPDATE decoder walks the path-attribute list in `pkg/packet/bgp/bgp.go:15773` and selects the concrete attribute parser from the attacker-controlled attribute type at `pkg/packet/bgp/bgp.go:15855`. For AS_PATH, `PathAttributeAsPath.DecodeFromBytes` returns nil when the decoded attribute length is zero (`pkg/packet/bgp/bgp.go:11533`, `pkg/packet/bgp/bgp.go:11538`), leaving `p.Value` empty rather than reporting a malformed attribute. Validation then dispatches each decoded attribute through `ValidateAttribute` (`pkg/packet/bgp/validate.go:34`); in the confederation eBGP branch, `pkg/packet/bgp/validate.go:162` indexes `p.Value[0]` before checking that any AS_P…

UBUNTU-CVE-2026-49838

Affected: Ubuntu:Pro:18.04:LTS: gobgp, Ubuntu:Pro:20.04:LTS: gobgp, Ubuntu:Pro:22.04:LTS: gobgp, Ubuntu:Pro:24.04:LTS: gobgp, Ubuntu:25.10: gobgp, Ubuntu:Pro:26.04:LTS: gobgp