-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/osrg/gobgp | go | < 3.35.0 | |
| github.com/osrg/gobgp/v3 | go | < 3.35.0 | 3.35.0 |
Miggo AIRoot Cause AnalysisThe provided commit directly patches the DecodeFromBytes function within the CapSoftwareVersion struct in the file pkg/packet/bgp/bgp.go. The patch adds a condition to an if statement to check if softwareVersionLen == 0. The commit message explicitly states that softwareVersionLen not being checked for 0 leads to data[1:c.SoftwareVersionLen] becoming data[1:0], which causes a runtime panic. This clearly identifies (*CapSoftwareVersion).DecodeFromBytes as the vulnerable function that processes potentially malicious input (the BGP capability data) and can be triggered to cause a denial of service (panic).
Ongoing coverage of React2Shell