What is GHSA-mfvv-mgf6-q25r?

GHSA-mfvv-mgf6-q25r is a security advisory published by GitHub Security Advisories with Medium severity. GoBGP crashes in the flowspec parser

Which CVE IDs does GHSA-mfvv-mgf6-q25r cover?

GHSA-mfvv-mgf6-q25r covers the following CVE IDs: CVE-2025-43972. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mfvv-mgf6-q25r?

GHSA-mfvv-mgf6-q25r has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

Which products are affected by GHSA-mfvv-mgf6-q25r?

GHSA-mfvv-mgf6-q25r affects 2 products, including: go/github.com/osrg/gobgp:\u003c 3.35.0; go/github.com/osrg/gobgp/v3:\u003c 3.35.0.

GHSA-mfvv-mgf6-q25rMediumCVSS 6.8

GoBGP crashes in the flowspec parser

Vendor

GitHub Security Advisories

Published

April 21, 2025

Last Modified

April 21, 2025

🔗 CVE IDs covered (1)

CVE-2025-43972 →

📋 Description

An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context.

🎯 Affected products2

go/github.com/osrg/gobgp:< 3.35.0
go/github.com/osrg/gobgp/v3:< 3.35.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2025-43972
https://github.com/osrg/gobgp/commit/ca7383f450f7b296c5389feceef2467de5ab6e5a
https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
https://github.com/advisories/GHSA-mfvv-mgf6-q25r