GHSA-hqhq-hp5x-xp3wMediumCVSS 4.3

GoBGP does not properly check the input length

Published
April 21, 2025
Last Modified
April 21, 2025

🔗 CVE IDs covered (1)

CVE-2025-43970 →

📋 Description

An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).

🎯 Affected products2

  • go/github.com/osrg/gobgp:< 3.35.0
  • go/github.com/osrg/gobgp/v3:< 3.35.0

🔗 References (4)