PT-2026-29028 · Osrg · Gobgp

Rensiru · Publicado 2026-01-01 · Atualizado 2026-04-08 · CVE-2026-5122

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions osrg GoBGP versions through 4.3.0

Description A security issue exists in osrg GoBGP up to version 4.3.0. The issue resides in the DecodeFromBytes function within the pkg/packet/bgp/bgp.go file, specifically in the BGP OPEN Message Handler component. Manipulation of the domainNameLen argument can lead to improper access controls. The attack can be initiated remotely and requires a high degree of complexity, with exploitability reported as difficult.

Recommendations Install the patch 2b09db390a3d455808363c53e409afe6b1b86d2d to address this issue.

Correção

Incorrect Privilege Assignment

Improper Access Control

Enumeração de Fraquezas

CWE-266

CWE-284

Identificadores relacionados

CVE-2026-5122

Produtos afetados

Gobgp

Referências · 15

• https://github.com/osrg/gobgp/pull/3343 · Correção
• https://github.com/osrg/gobgp/commit/2b09db390a3d455808363c53e409afe6b1b86d2d · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5122 · Aviso do Fabricante
• https://vuldb.com/vuln/354154/cti · Nota
• https://vuldb.com/vuln/354154 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-5122 · Nota de Segurança
• https://ubuntu.com/security/CVE-2026-5122 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2039007086869123421 · Publicação no Twitter
• https://security-tracker.debian.org/tracker/CVE-2026-5122 · Aviso do Fabricante
• https://github.com/osrg/gobgp · Nota
• https://twitter.com/CVEnew/status/2039004532458373147 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5122 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-5122 · Nota de Segurança
• https://t.me/cveNotify/158469 · Publicação no Telegram
• https://vuldb.com/submit/780124 · Nota