MEDIUM4.3

GHSA-hqhq-hp5x-xp3w

GoBGP does not properly check the input length

Quick fix

GHSA-hqhq-hp5x-xp3w — github.com/osrg/gobgp/v3: upgrade to the fixed version with the command below.

go get github.com/osrg/gobgp/v3@v3.35.0

Details

An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/osrg/gobgp

Introduced in: 0

No fixed version published yet for github.com/osrg/gobgp (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/osrg/gobgp/v3

Introduced in: 0Fixed in: 3.35.0

Fixgo get github.com/osrg/gobgp/v3@v3.35.0

References

https://nvd.nist.gov/vuln/detail/CVE-2025-43970[ADVISORY]
https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0[WEB]
https://github.com/osrg/gobgp[PACKAGE]
https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0[WEB]