CVE-2025-43973: GoBGP does not verify that the input length

April 21, 2025

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.

References

github.com/advisories/GHSA-c5jg-wr5v-2wp2
github.com/osrg/gobgp
github.com/osrg/gobgp/commit/5693c58a4815cc6327b8d3b6980f0e5aced28abe
github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
nvd.nist.gov/vuln/detail/CVE-2025-43973

Code Behaviors & Features

Detect and mitigate CVE-2025-43973 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →