What is the CVSS score of CVE-2025-43971?

CVE-2025-43971 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Gobgp are affected by CVE-2025-43971?

Organizations using GoBGP face significant risk from CVE-2025-43971 rated CVSS 8.6.. A patch is available.

How to fix or mitigate CVE-2025-43971?

Within 7 days: Identify all affected systems running GoBGP and apply vendor patches promptly. Vendor patch is available.

Gobgp CVE-2025-43971

HIGH

Off-by-one Error (CWE-193)

2025-04-21 cve@mitre.org

Information Disclosure Suse Gobgp

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:38 vuln.today

Patch released

Mar 28, 2026 - 18:38 nvd

Patch available

CVE Published

Apr 21, 2025 - 01:15 nvd

HIGH 8.6

DescriptionCVE.org

An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen.

AnalysisAI

An issue was discovered in GoBGP before 3.35.0. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-193. An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen. Affected products include: Osrg Gobgp. Version information: before 3.35.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Gobgp

View all

CVE-2026-7735 MEDIUM This Month

6.9 May 04

Buffer overflow in GoBGP's AIGP Attribute Parser allows remote unauthenticated attackers to manipulate the PathAttribute

CVE-2025-43973 MEDIUM This Month

6.8 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploit

CVE-2025-43972 MEDIUM This Month

6.8 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploit

CVE-2026-5123 MEDIUM This Month

6.3 Mar 30

Denial of service in osrg GoBGP up to version 4.3.0 via off-by-one error in the DecodeFromBytes function allows remote,

CVE-2026-5124 MEDIUM This Month

6.3 Mar 30

Improper access controls in osrg GoBGP up to version 4.3.0 allow remote attackers to bypass authentication via manipulat

CVE-2026-5122 MEDIUM This Month

6.3 Mar 30

Improper access control in osrg GoBGP up to 4.3.0 allows remote attackers to manipulate the domainNameLen parameter in B

CVE-2025-43970 MEDIUM This Month

4.3 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 4.3), this vulnerability is no authenticatio

Same weakness CWE-193 – Off-by-one Error

View all

CVE-2026-56790 HIGH POC

7.0

CVE-2026-56787 MEDIUM POC

6.9

CVE-2026-21870 MEDIUM POC

5.5

CVE-2026-26309 MEDIUM POC

5.3

8.8

8.6

8.4

8.4

Same technique Information Disclosure

View all

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2014-6324 HIGH POC

8.8

CVE-2017-0213 HIGH POC

7.3

CVE-2016-7255 HIGH POC

7.8

CVE-2010-0232 HIGH POC

7.8

CVE-2025-30066 HIGH POC

8.6

CVE-2025-54236 CRITICAL POC

9.1

Vendor StatusVendor

SUSE

Severity: High

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE	Affected
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed

CVE-2025-43971 vulnerability details – vuln.today

Back

Gobgp CVE-2025-43971

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Gobgp

Same weakness CWE-193 – Off-by-one Error

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code