CVE-2025-43973: GoBGP does not verify that the input length
6.8
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.04353%
CWE
Published
4/21/2025
Updated
4/21/2025
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/osrg/gobgp | go | < 3.35.0 | |
| github.com/osrg/gobgp/v3 | go | < 3.35.0 | 3.35.0 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability description clearly states that pkg/packet/rtr/rtr.go does not verify input length for RTR messages. The provided commit 5693c58a4815cc6327b8d3b6980f0e5aced28abe directly addresses this by adding a length check at the beginning of the ParseRTR function in that file. This function is responsible for parsing RTR messages, and the lack of this check before the patch made it vulnerable to processing malformed or truncated messages, potentially leading to a denial of service or other issues. The patch itself is the primary evidence for identifying ParseRTR as the vulnerable function.