CVE-2025-43971: GoBGP panics due to a zero value for softwareVersionLen
8.6
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.18866%
CWE
Published
4/21/2025
Updated
4/21/2025
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/osrg/gobgp | go | < 3.35.0 | |
| github.com/osrg/gobgp/v3 | go | < 3.35.0 | 3.35.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The provided commit directly patches the DecodeFromBytes function within the CapSoftwareVersion struct in the file pkg/packet/bgp/bgp.go. The patch adds a condition to an if statement to check if softwareVersionLen == 0. The commit message explicitly states that softwareVersionLen not being checked for 0 leads to data[1:c.SoftwareVersionLen] becoming data[1:0], which causes a runtime panic. This clearly identifies (*CapSoftwareVersion).DecodeFromBytes as the vulnerable function that processes potentially malicious input (the BGP capability data) and can be triggered to cause a denial of service (panic).