TI-2025-28531 Aliases CVE-2025-43973 GHSA-c5jg-wr5v-2wp2

An issue was discovered in GoBGP before 3.35.0.

MEDIUM 43CWE-193Published 2025-04-21 · Updated 2025-04-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-193 and the CVSS impact.

Summary

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00573 47th percentileScored 2026-11-07

Fix Fixed GoBGP (GoBGP): 3.35.0github.com/osrg/gobgp/v3 (Go): 3.35.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
osrg	GoBGP	before 3.35.0	3.35.0	Patch available	CNA
—	github.com/osrg/gobgp (Go)	all versions	—	No fix listed	GHSA-c5jg-wr5v-2wp2
—	github.com/osrg/gobgp/v3 (Go)	before 3.35.0	3.35.0	Patch available	GHSA-c5jg-wr5v-2wp2

GoBGP Vendorosrg Affected before 3.35.0 Fixed in 3.35.0 Patch available CNA
github.com/osrg/gobgp (Go) Vendor— Affected all versions Fixed in — No fix listed GHSA-c5jg-wr5v-2wp2
github.com/osrg/gobgp/v3 (Go) Vendor— Affected before 3.35.0 Fixed in 3.35.0 Patch available GHSA-c5jg-wr5v-2wp2

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:osrg:gobgp::::::::	before 3.35.0	Vulnerable	osrg

cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:* Versions before 3.35.0 Vulnerable ·osrg

Remediation

Fix · CNA GoBGP (GoBGP) Fixed in 3.35.0
Fix · GHSA-c5jg-wr5v-2wp2 github.com/osrg/gobgp/v3 (Go) Fixed in 3.35.0 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-04-21
GoBGP 3.35.0
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2025-28529 An issue was discovered in GoBGP before 3.35.0.Priority MEDIUM 44
- TI-2025-28530 An issue was discovered in GoBGP before 3.35.0.Priority LOW 34
- TI-2025-28528 An issue was discovered in GoBGP before 3.35.0.Priority LOW 24
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-43973
2026-10-03 Alias added: GHSA-c5jg-wr5v-2wp2

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-43973

Other 1

https://github.com/osrg/gobgp

TI-2026-30596 GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) CVSS 3.1HIGH 7.5
TI-2026-30162 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE CVSS 3.1HIGH 7.5
TI-2026-30161 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute CVSS 3.1HIGH 7.5
TI-2026-23526 An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute CVSS 3.1HIGH 7.5
TI-2025-28529 An issue was discovered in GoBGP before 3.35.0. CVSS 3.1HIGH 8.6
TI-2026-28050 An out-of-bounds read in the ParseIP6Extended function (/bgp/bgp.go) of gobgp v4.3.0… CVSS 3.1HIGH 7.5

See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences