This vulnerability is an out‑of‑bounds read in the BGP OPEN capability parser of GoBGP. Versions prior to 4.6.0 contain this parsing issue, where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, CapLen. The parser incorrectly processes the buffer, causing bytes from a following capability to be interpreted as part of the current capability. is the 4‑octet AS capability, where a capability with CapLen == 0 may cause the parser to4‑octet AS value, which may later affect peer AS validation during BGP session establishment. This parsed value may be forged, potentially allowing an unauthorized BGP session to be established with an attacker’s chosen AS.

Affected product: GoBGP from osrg. All releases earlier than version 4.6.0 are impacted; version 4.6.0 and later contain the fix.

The CVSS score is 5.9, indicating a moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, but exploitation requires a specially crafted BGP OPEN message sent to the vulnerable instance. The attack vector is network‑based, targeting the BGP control plane. While the probability of exploitation cannot be quantified, the potential impact on AS validation and routing integrity warrants immediate attention.