What is the CVSS score of CVE-2025-43970?

CVE-2025-43970 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Gobgp are affected by CVE-2025-43970?

Organizations using GoBGP should be aware of moderate risk from CVE-2025-43970 rated CVSS 4.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-43970?

Within 30 days: Identify affected systems running GoBGP and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Gobgp CVE-2025-43970

MEDIUM

Improper Validation of Specified Quantity in Input (CWE-1284)

2025-04-21 cve@mitre.org

Information Disclosure Suse Gobgp

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:38 vuln.today

Patch released

Mar 28, 2026 - 18:38 nvd

Patch available

CVE Published

Apr 21, 2025 - 01:15 nvd

MEDIUM 4.3

DescriptionCVE.org

An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).

AnalysisAI

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-1284. An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family). Affected products include: Osrg Gobgp. Version information: before 3.35.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Gobgp

View all

CVE-2025-43971 HIGH This Week

8.6 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitab

CVE-2026-7735 MEDIUM This Month

6.9 May 04

Buffer overflow in GoBGP's AIGP Attribute Parser allows remote unauthenticated attackers to manipulate the PathAttribute

CVE-2025-43973 MEDIUM This Month

6.8 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploit

CVE-2025-43972 MEDIUM This Month

6.8 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploit

CVE-2026-5123 MEDIUM This Month

6.3 Mar 30

Denial of service in osrg GoBGP up to version 4.3.0 via off-by-one error in the DecodeFromBytes function allows remote,

CVE-2026-5124 MEDIUM This Month

6.3 Mar 30

Improper access controls in osrg GoBGP up to version 4.3.0 allow remote attackers to bypass authentication via manipulat

CVE-2026-5122 MEDIUM This Month

6.3 Mar 30

Improper access control in osrg GoBGP up to 4.3.0 allows remote attackers to manipulate the domainNameLen parameter in B

Same weakness CWE-1284 – Improper Validation of Specified Quantity in Input

View all

CVE-2025-9316 MEDIUM POC

6.9

CVE-2026-49777 CRITICAL POC

10.0

CVE-2025-65548 CRITICAL POC

9.1

CVE-2023-54337 CRITICAL POC

9.1

CVE-2025-5349 HIGH POC

8.8

CVE-2026-30573 HIGH POC

7.5

CVE-2021-47824 HIGH POC

7.5

CVE-2021-47831 HIGH POC

7.5

Same technique Information Disclosure

View all

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2014-6324 HIGH POC

8.8

CVE-2017-0213 HIGH POC

7.3

CVE-2016-7255 HIGH POC

7.8

CVE-2010-0232 HIGH POC

7.8

CVE-2025-30066 HIGH POC

8.6

CVE-2025-54236 CRITICAL POC

9.1

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE	Affected
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed

CVE-2025-43970 vulnerability details – vuln.today

Back

Gobgp CVE-2025-43970

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Gobgp

Same weakness CWE-1284 – Improper Validation of Specified Quantity in Input

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code