Read the docs
TI-2025-28530 Aliases CVE-2025-43972GHSA-mfvv-mgf6-q25r

An issue was discovered in GoBGP before 3.35.0.

Priority LOW 34CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00559 46th percentileScored 2026-11-07
Fix Fixed GoBGP (GoBGP): 3.35.0github.com/osrg/gobgp/v3 (Go): 3.35.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
osrgGoBGPbefore 3.35.03.35.0Patch availableCNA
—github.com/osrg/gobgp (Go)all versions—No fix listedGHSA-mfvv-mgf6-q25r
—github.com/osrg/gobgp/v3 (Go)before 3.35.03.35.0Patch availableGHSA-mfvv-mgf6-q25r
  • GoBGP Vendorosrg Affected before 3.35.0 Fixed in 3.35.0 Patch available CNA
  • github.com/osrg/gobgp (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-mfvv-mgf6-q25r
  • github.com/osrg/gobgp/v3 (Go) Vendor— Affected before 3.35.0 Fixed in 3.35.0 Patch available GHSA-mfvv-mgf6-q25r

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:*before 3.35.0Vulnerableosrg
  • cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:* Versions before 3.35.0 Vulnerable ·osrg

Remediation

  • Fix · CNA GoBGP (GoBGP) Fixed in 3.35.0
  • Fix · GHSA-mfvv-mgf6-q25r github.com/osrg/gobgp/v3 (Go) Fixed in 3.35.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GoBGP 3.35.0

    4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-28529 An issue was discovered in GoBGP before 3.35.0.Priority MEDIUM 44
    • TI-2025-28531 An issue was discovered in GoBGP before 3.35.0.Priority MEDIUM 43
    • TI-2025-28528 An issue was discovered in GoBGP before 3.35.0.Priority LOW 24
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-43972
  2. 2026-10-03 Alias added: GHSA-mfvv-mgf6-q25r

References

Patch 2

Advisory 1

Other 1

  • TI-2026-30596 GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) CVSS 3.1HIGH 7.5
  • TI-2026-30162 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE CVSS 3.1HIGH 7.5
  • TI-2026-30161 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute CVSS 3.1HIGH 7.5
  • TI-2026-23526 An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute CVSS 3.1HIGH 7.5
  • TI-2025-28529 An issue was discovered in GoBGP before 3.35.0. CVSS 3.1HIGH 8.6
  • TI-2025-28531 An issue was discovered in GoBGP before 3.35.0. CVSS 3.1CRITICAL 9.8
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences