GoBGP does not properly check the input length
An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).
02 / AFFECTED SOFTWARE
Affected packages
107 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).
An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).
GoBGP does not properly check the input length in github.com/osrg/gobgp
05 / REFERENCES
Further evidence
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43970.json
- https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0
- https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
- https://nvd.nist.gov/vuln/detail/CVE-2025-43970
- https://github.com/osrg/gobgp
- https://github.com/advisories/GHSA-hqhq-hp5x-xp3w