GitHub Advisoryadvisory · Go

GHSA-7m35-vw2c-696v GoBGP panics due to a zero value for softwareVersionLen

HIGH Published 2025-04-21 Modified 2026-03-12 Official page ↗
Aliases
CVE-2025-43971
Ecosystem
Go
Packages
github.com/osrg/gobgp/v3
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Weaknesses
CWE-193
Reviewed
2025-04-21

Affected packages

• Go github.com/osrg/gobgp/v3: >= 3.11.0, < 3.35.0 → fixed in 3.35.0

Description

An issue was discovered in GoBGP before 3.35.0 (introduced in v3.11.0). pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen.

Related

Alias · CVE (1)

  • CVE-2025-43971 An issue was discovered in GoBGP before 3.35.0. vulnerability

Weakness · CWE (1)

  • CWE-193 Off-by-one Error weakness

References