PT-2026-29046 · Osrg · Gobgp

Sunxj · Publicado 2026-01-01 · Atualizado 2026-03-31 · CVE-2026-5123

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions osrg GoBGP versions through 4.3.0

Description A weakness exists in the DecodeFromBytes function within the pkg/packet/bgp/bgp.go file of osrg GoBGP. Manipulating the data[1] argument can lead to an off-by-one error. The attack can be launched remotely and is considered highly complex with difficult exploitability. The identified patch is 67c059413470df64bc20801c46f64058e88f800f.

Recommendations Apply the patch 67c059413470df64bc20801c46f64058e88f800f to address the issue.

Correção

Enumeração de Fraquezas

CWE-189

CWE-193

Identificadores relacionados

CVE-2026-5123

Produtos afetados

Gobgp

Referências · 14

• https://github.com/osrg/gobgp/pull/3342 · Correção
• https://github.com/osrg/gobgp/commit/67c059413470df64bc20801c46f64058e88f800f · Correção
• https://twitter.com/infoflowcloud/status/2039006802885456040 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2039004528415023537 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-5123 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2026-5123 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5123 · Aviso do Fabricante
• https://vuldb.com/vuln/354155 · Nota
• https://ubuntu.com/security/CVE-2026-5123 · Aviso do Fabricante
• https://vuldb.com/submit/780179 · Nota
• https://vuldb.com/vuln/354155/cti · Nota
• https://github.com/osrg/gobgp · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5123 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2026-5123 · Aviso do Fabricante