-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGo| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/osrg/gobgp | go | < 3.35.0 | |
| github.com/osrg/gobgp/v3 | go | < 3.35.0 | 3.35.0 |
Miggo AIRoot Cause AnalysisThe vulnerability description clearly states that pkg/packet/rtr/rtr.go does not verify input length for RTR messages. The provided commit 5693c58a4815cc6327b8d3b6980f0e5aced28abe directly addresses this by adding a length check at the beginning of the ParseRTR function in that file. This function is responsible for parsing RTR messages, and the lack of this check before the patch made it vulnerable to processing malformed or truncated messages, potentially leading to a denial of service or other issues. The patch itself is the primary evidence for identifying ParseRTR as the vulnerable function.
Ongoing coverage of React2Shell