MEDIUM6.8

GHSA-c5jg-wr5v-2wp2

GoBGP does not verify that the input length

Quick fix

GHSA-c5jg-wr5v-2wp2 — github.com/osrg/gobgp/v3: upgrade to the fixed version with the command below.

go get github.com/osrg/gobgp/v3@v3.35.0

Details

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/osrg/gobgp

Introduced in: 0

No fixed version published yet for github.com/osrg/gobgp (go modules). Pin to a known-safe version or switch to an alternative.

Go/github.com/osrg/gobgp/v3

Introduced in: 0Fixed in: 3.35.0

Fixgo get github.com/osrg/gobgp/v3@v3.35.0

References

https://nvd.nist.gov/vuln/detail/CVE-2025-43973[ADVISORY]
https://github.com/osrg/gobgp/commit/5693c58a4815cc6327b8d3b6980f0e5aced28abe[WEB]
https://github.com/osrg/gobgp[PACKAGE]
https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0[WEB]