The issue is in the BGP OPEN capability parser under: - "pkg/packet/bgp/bgp.go" - "pkg/packet/bgp/validate.go" - The BGP OPEN optional parameter capability format includes a capability code, a capability length field, and a capability value. Each concrete capability decoder should only parse bytes inside the declared capability value boundary. In affected versions, the generic capability parser records the declared "CapLen", but several concrete capability decoders continue parsing from the full remaining capability buffer after advancing past the two-byte capability header. Conceptually, the vulnerable pattern is: