What is GHSA-c5jg-wr5v-2wp2?

GHSA-c5jg-wr5v-2wp2 is a security advisory published by GitHub Security Advisories with Medium severity. GoBGP does not verify that the input length

Which CVE IDs does GHSA-c5jg-wr5v-2wp2 cover?

GHSA-c5jg-wr5v-2wp2 covers the following CVE IDs: CVE-2025-43973. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-c5jg-wr5v-2wp2?

GHSA-c5jg-wr5v-2wp2 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

Which products are affected by GHSA-c5jg-wr5v-2wp2?

GHSA-c5jg-wr5v-2wp2 affects 2 products, including: go/github.com/osrg/gobgp:\u003c 3.35.0; go/github.com/osrg/gobgp/v3:\u003c 3.35.0.

GHSA-c5jg-wr5v-2wp2MediumCVSS 6.8

GoBGP does not verify that the input length

Vendor

GitHub Security Advisories

Published

April 21, 2025

Last Modified

April 21, 2025

🔗 CVE IDs covered (1)

CVE-2025-43973 →

📋 Description

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.

🎯 Affected products2

go/github.com/osrg/gobgp:< 3.35.0
go/github.com/osrg/gobgp/v3:< 3.35.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-43973
https://github.com/osrg/gobgp/commit/5693c58a4815cc6327b8d3b6980f0e5aced28abe
https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
https://github.com/advisories/GHSA-c5jg-wr5v-2wp2