Is there a patch available for EUVD-2026-17091?

Yes, a patch is available for EUVD-2026-17091. Update the affected software to the latest version immediately.

Gobgp EUVD-2026-17091

Q: What is the CVSS score of EUVD-2026-17091?

EUVD-2026-17091 has a CVSS 4.0 base score of 6.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-5122 MEDIUM

Improper Access Control (CWE-284)

2026-03-30 VulDB

Authentication Bypass Gobgp Osrg

6.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 30, 2026 - 15:00 euvd

EUVD-2026-17091

Analysis Generated

Mar 30, 2026 - 15:00 vuln.today

Patch released

Mar 30, 2026 - 15:00 nvd

Patch available

CVE Published

Mar 30, 2026 - 14:15 nvd

MEDIUM 6.3

DescriptionCVE.org

A security flaw has been discovered in osrg GoBGP up to 4.3.0. This affects the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP OPEN Message Handler. Performing a manipulation of the argument domainNameLen results in improper access controls. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The patch is named 2b09db390a3d455808363c53e409afe6b1b86d2d. It is suggested to install a patch to address this issue.

AnalysisAI

Improper access control in osrg GoBGP up to 4.3.0 allows remote attackers to manipulate the domainNameLen parameter in BGP OPEN Message processing, resulting in integrity compromise through the DecodeFromBytes function. The vulnerability requires high attack complexity and has low real-world risk despite network-accessible attack vector; no public exploit code or confirmed active exploitation has been identified. A vendor patch is available via upstream commit 2b09db390a3d455808363c53e409afe6b1b86d2d.

Technical ContextAI

GoBGP is an open-source Border Gateway Protocol (BGP) daemon implementation. The vulnerability resides in the BGP OPEN Message Handler component, specifically in the DecodeFromBytes function within pkg/packet/bgp/bgp.go. BGP OPEN messages are the first messages exchanged during BGP session establishment and contain critical protocol parameters. The flaw involves improper validation of the domainNameLen argument, which controls message parsing logic and access control decisions. CWE-284 (Improper Access Control) indicates the root cause is a failure to properly restrict operations based on authentication or privilege level, in this case during message deserialization.

RemediationAI

Upgrade osrg GoBGP to a patched version released after commit 2b09db390a3d455808363c53e409afe6b1b86d2d. The upstream fix is available at https://github.com/osrg/gobgp/commit/2b09db390a3d455808363c53e409afe6b1b86d2d and via the pull request https://github.com/osrg/gobgp/pull/3343. Operators should apply the patch to prevent potential integrity compromise of BGP message processing. No workarounds are documented; patching is the primary remediation path. Organizations should prioritize this update based on deployment criticality and network exposure of GoBGP instances.