Is there a patch available for CVE-2026-5123?

Yes, a patch is available for CVE-2026-5123. Update the affected software to the latest version immediately.

Gobgp CVE-2026-5123

Q: What is the CVSS score of CVE-2026-5123?

CVE-2026-5123 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17109 MEDIUM

Off-by-one Error (CWE-193)

2026-03-30 VulDB

Information Disclosure Gobgp Osrg

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 30, 2026 - 16:00 euvd

EUVD-2026-17109

Analysis Generated

Mar 30, 2026 - 16:00 vuln.today

Patch released

Mar 30, 2026 - 16:00 nvd

Patch available

CVE Published

Mar 30, 2026 - 15:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A weakness has been identified in osrg GoBGP up to 4.3.0. This impacts the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go. Executing a manipulation of the argument data[1] can lead to off-by-one. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is said to be difficult. This patch is called 67c059413470df64bc20801c46f64058e88f800f. A patch should be applied to remediate this issue.

AnalysisAI

Denial of service in osrg GoBGP up to version 4.3.0 via off-by-one error in the DecodeFromBytes function allows remote, unauthenticated attackers to crash the BGP daemon through manipulation of packet data, resulting in availability impact. The vulnerability requires high attack complexity and has difficult exploitability; no public exploit code or active exploitation is currently confirmed, though a patch is available from the vendor.

Technical ContextAI

The vulnerability exists in the BGP packet parsing logic (pkg/packet/bgp/bgp.go) in the DecodeFromBytes function, which is responsible for deserializing BGP protocol messages. An off-by-one error (CWE-193) in boundary checking when processing the data[1] argument allows an attacker to trigger an out-of-bounds access condition. BGP operates as a TCP-based protocol (RFC 4271) used for inter-domain routing; the DecodeFromBytes function is a critical parsing function that processes incoming BGP UPDATE, KEEPALIVE, NOTIFICATION, and OPEN messages. The off-by-one flaw suggests improper array or buffer indexing during packet deserialization, which can cause memory access violations leading to process termination.

RemediationAI

Upgrade osrg GoBGP to a version incorporating commit 67c059413470df64bc20801c46f64058e88f800f or later. The fix is available via GitHub pull request https://github.com/osrg/gobgp/pull/3342 and commit https://github.com/osrg/gobgp/commit/67c059413470df64bc20801c46f64058e88f800f. Users should obtain the patched release from the osrg/gobgp repository (https://github.com/osrg/gobgp/) once a tagged release incorporating this commit is available. Until patching is possible, operators can mitigate risk by restricting BGP peer connectivity to trusted sources and implementing network access controls on BGP ports (TCP 179), though this is a temporary measure only.