CVE-2025-43973
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.
02 / AFFECTED SOFTWARE
Affected packages
107 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.
GoBGP does not verify that the input length in github.com/osrg/gobgp
05 / REFERENCES
Further evidence
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43973.json
- https://github.com/osrg/gobgp/commit/5693c58a4815cc6327b8d3b6980f0e5aced28abe
- https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
- https://nvd.nist.gov/vuln/detail/CVE-2025-43973
- https://github.com/osrg/gobgp
- https://github.com/advisories/GHSA-c5jg-wr5v-2wp2