CVE-2025-43970

Published: Apr 21, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).

Affected (1)

Products: Osrg: Gobgp

Osrg

1 product

Gobgp

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Osrg Gobgp	Before 3.35.0

Related CWEs

CWE-1284

Improper Validation of Specified Quantity in Input

The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

References (2)

https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0

Source: cve@mitre.org

Patch

https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0

Source: cve@mitre.org

PatchRelease Notes

Timeline

No history available yet.