CVE-2026-5123
6.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
Summary
A weakness has been identified in osrg GoBGP up to 4.3.0. This impacts the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go. Executing a manipulation of the argument data[1] can lead to off-by-one. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is said to be difficult. This patch is called 67c059413470df64bc20801c46f64058e88f800f. A patch should be applied to remediate this issue.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| osrg | GoBGP | 4.0 | affected |
| osrg | GoBGP | 4.1 | affected |
| osrg | GoBGP | 4.2 | affected |
| osrg | GoBGP | 4.3.0 | affected |
Weaknesses
- CWE-193: Off-by-One
- CWE-189: Numeric Error
ADP Enrichment
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
- https://vuldb.com/vuln/354155
- https://vuldb.com/vuln/354155/cti
- https://vuldb.com/submit/780179
- https://github.com/osrg/gobgp/pull/3342
- https://github.com/osrg/gobgp/commit/67c059413470df64bc20801c46f64058e88f800f
- https://github.com/osrg/gobgp/
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.