What is the CVSS score of CVE-2025-43973?

CVE-2025-43973 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Gobgp are affected by CVE-2025-43973?

Organizations using GoBGP should be aware of notable risk from CVE-2025-43973 rated CVSS 6.8. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-43973?

Within 30 days: Identify affected systems running GoBGP and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Gobgp CVE-2025-43973

MEDIUM

Off-by-one Error (CWE-193)

2025-04-21 cve@mitre.org

Information Disclosure Suse Gobgp

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:38 vuln.today

Patch released

Mar 28, 2026 - 18:38 nvd

Patch available

CVE Published

Apr 21, 2025 - 01:15 nvd

MEDIUM 6.8

DescriptionCVE.org

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.

AnalysisAI

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, no authentication required.

Technical ContextAI

This vulnerability is classified under CWE-193. An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message. Affected products include: Osrg Gobgp. Version information: before 3.35.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Gobgp

View all

CVE-2025-43971 HIGH This Week

8.6 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitab

CVE-2026-7735 MEDIUM This Month

6.9 May 04

Buffer overflow in GoBGP's AIGP Attribute Parser allows remote unauthenticated attackers to manipulate the PathAttribute

CVE-2025-43972 MEDIUM This Month

6.8 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploit

CVE-2026-5123 MEDIUM This Month

6.3 Mar 30

Denial of service in osrg GoBGP up to version 4.3.0 via off-by-one error in the DecodeFromBytes function allows remote,

CVE-2026-5124 MEDIUM This Month

6.3 Mar 30

Improper access controls in osrg GoBGP up to version 4.3.0 allow remote attackers to bypass authentication via manipulat

CVE-2026-5122 MEDIUM This Month

6.3 Mar 30

Improper access control in osrg GoBGP up to 4.3.0 allows remote attackers to manipulate the domainNameLen parameter in B

CVE-2025-43970 MEDIUM This Month

4.3 Apr 21

An issue was discovered in GoBGP before 3.35.0. Rated medium severity (CVSS 4.3), this vulnerability is no authenticatio

Same weakness CWE-193 – Off-by-one Error

View all

CVE-2026-56790 HIGH POC

7.0

CVE-2026-56787 MEDIUM POC

6.9

CVE-2026-21870 MEDIUM POC

5.5

CVE-2026-26309 MEDIUM POC

5.3

8.8

8.6

8.6

8.4

Same technique Information Disclosure

View all

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2014-6324 HIGH POC

8.8

CVE-2017-0213 HIGH POC

7.3

CVE-2016-7255 HIGH POC

7.8

CVE-2010-0232 HIGH POC

7.8

CVE-2025-30066 HIGH POC

8.6

CVE-2025-54236 CRITICAL POC

9.1

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE	Affected
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed

CVE-2025-43973 vulnerability details – vuln.today

Back

Gobgp CVE-2025-43973

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Gobgp

Same weakness CWE-193 – Off-by-one Error

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code