CVE-2025-43970

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-43970
An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0
https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
Configurations

No configuration.

History

21 Apr 2025, 02:15

Type Values Removed Values Added
Summary (en) An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g.. by ensuring that there are 12 bytes or 36 bytes (depending on the address family). (en) An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).

21 Apr 2025, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-21 01:15

Updated : 2025-04-21 14:23

NVD link : CVE-2025-43970

Mitre link : CVE-2025-43970

CVE.ORG link : CVE-2025-43970

JSON object : View

Products Affected

No product.

CWE
CWE-1284

Improper Validation of Specified Quantity in Input