Is there a patch available for CVE-2026-5124?

Yes, a patch is available for CVE-2026-5124. Update the affected software to the latest version immediately.

Gobgp CVE-2026-5124

Q: What is the CVSS score of CVE-2026-5124?

CVE-2026-5124 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-17139 MEDIUM

Improper Access Control (CWE-284)

2026-03-30 VulDB

Authentication Bypass Gobgp Osrg

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 30, 2026 - 16:45 euvd

EUVD-2026-17139

Analysis Generated

Mar 30, 2026 - 16:45 vuln.today

Patch released

Mar 30, 2026 - 16:45 nvd

Patch available

CVE Published

Mar 30, 2026 - 16:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A security vulnerability has been detected in osrg GoBGP up to 4.3.0. Affected is the function BGPHeader.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP Header Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is told to be difficult. The identifier of the patch is f0f24a2a901cbf159260698211ab15c583ced131. To fix this issue, it is recommended to deploy a patch.

AnalysisAI

Improper access controls in osrg GoBGP up to version 4.3.0 allow remote attackers to bypass authentication via manipulation of the BGP Header Handler's DecodeFromBytes function. The vulnerability affects the BGP packet parsing mechanism and enables unauthorized modifications to BGP protocol state without requiring authentication. With a CVSS score of 3.7 and high attack complexity, exploitation is difficult but possible over the network; no public exploit code or active exploitation has been confirmed.

Technical ContextAI

GoBGP is an open-source BGP (Border Gateway Protocol) implementation written in Go. The vulnerability resides in the BGPHeader.DecodeFromBytes function within pkg/packet/bgp/bgp.go, which handles deserialization and validation of incoming BGP protocol headers. CWE-284 (Improper Access Control) indicates that the function fails to properly validate or authorize operations on BGP header data during parsing. This suggests the vulnerability allows an unauthenticated remote attacker to craft malformed or unauthorized BGP packets that bypass access control checks enforced at the header parsing layer, potentially enabling state modifications in BGP routing decisions or protocol negotiation.

RemediationAI

Apply the upstream patch identified by commit f0f24a2a901cbf159260698211ab15c583ced131, available via GitHub PR #3340 at https://github.com/osrg/gobgp/pull/3340. Update GoBGP to a version incorporating this fix (post-4.3.0). No workarounds for the authentication bypass are documented; patching is the recommended primary remediation. Users should verify the patched version availability from the osrg GoBGP repository at https://github.com/osrg/gobgp/ and test in non-production environments before deployment.