Skip to main content

Gobgp CVE-2025-43971

HIGH
Off-by-one Error (CWE-193)
2025-04-21 cve@mitre.org
Information Disclosure Suse Gobgp Osrg
8.6
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.6 HIGH
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
SUSE
HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 28, 2026 - 18:38 vuln.today
Patch released
Mar 28, 2026 - 18:38 nvd
Patch available
CVE Published
Apr 21, 2025 - 01:15 nvd
HIGH 8.6

DescriptionCVE.org

An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen.

AnalysisAI

An issue was discovered in GoBGP before 3.35.0. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-193. An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen. Affected products include: Osrg Gobgp. Version information: before 3.35.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Gobgp

View all
CVE-2026-7735 MEDIUM
6.9 May 04

Buffer overflow in GoBGP's AIGP Attribute Parser allows remote unauthenticated attackers to manipulate the PathAttribute
CVE-2026-7734 MEDIUM
6.9 May 04

Denial of service in osrg GoBGP up to version 4.3.0 allows remote attackers to trigger an infinite loop via malformed SR
CVE-2026-7737 MEDIUM
6.9 May 04

Out-of-bounds read in GoBGP BMP parser allows remote attackers to trigger information disclosure via malformed BMP messa
CVE-2026-7736 MEDIUM
6.9 May 04

Integer underflow in osrg GoBGP up to version 4.3.0 allows remote attackers to trigger a crash or information disclosure
CVE-2025-43973 MEDIUM
6.8 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploit
CVE-2025-43972 MEDIUM
6.8 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploit
CVE-2026-5123 MEDIUM
6.3 Mar 30

Denial of service in osrg GoBGP up to version 4.3.0 via off-by-one error in the DecodeFromBytes function allows remote,

CVE-2026-5124 MEDIUM
6.3 Mar 30

Improper access controls in osrg GoBGP up to version 4.3.0 allow remote attackers to bypass authentication via manipulat
CVE-2026-5122 MEDIUM
6.3 Mar 30

Improper access control in osrg GoBGP up to 4.3.0 allows remote attackers to manipulate the domainNameLen parameter in B
CVE-2025-43970 MEDIUM
4.3 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 4.3), this vulnerability is no authenticatio

Same weakness CWE-193 – Off-by-one Error

View all
CVE-2021-3156 HIGH POC
7.8
CVE-2022-34970 CRITICAL POC
9.8
CVE-2021-31875 CRITICAL POC
9.8
CVE-2020-8443 CRITICAL POC
9.8
CVE-2019-14532 CRITICAL POC
9.8
CVE-2026-86297 HIGH POC
8.2
CVE-2019-13306 HIGH POC
7.8
CVE-2019-13305 HIGH POC
7.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
SUSE Linux Enterprise Server 16.0 Fixed
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Server 16.1 Fixed
SUSE Linux Enterprise Server for SAP applications 16.1 Fixed

Share

CVE-2025-43971 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy