PT-2026-29060 · Osrg · Gobgp

Sunxj · Publicado 2026-01-01 · Atualizado 2026-03-31 · CVE-2026-5124

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Média

Vetor base

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions osrg GoBGP versions through 4.3.0

Description A security issue has been identified in osrg GoBGP. The BGPHeader.DecodeFromBytes function within the BGP Header Handler component, located in the file pkg/packet/bgp/bgp.go, is susceptible to improper access controls. Remote exploitation is possible, and the attack is considered to have high complexity with difficult exploitability.

Recommendations Deploy the patch with identifier f0f24a2a901cbf159260698211ab15c583ced131.

Correção

Incorrect Privilege Assignment

Improper Access Control

Enumeração de Fraquezas

CWE-266

CWE-284

Identificadores relacionados

CVE-2026-5124

Produtos afetados

Gobgp

Referências · 14

• https://github.com/osrg/gobgp/pull/3340 · Correção
• https://github.com/osrg/gobgp/commit/f0f24a2a901cbf159260698211ab15c583ced131 · Correção
• https://security-tracker.debian.org/tracker/CVE-2026-5124 · Aviso do Fabricante
• https://vuldb.com/submit/780189 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5124 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-5124 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2026-5124 · Nota de Segurança
• https://twitter.com/infoflowcloud/status/2039006487876346162 · Publicação no Twitter
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5124 · Aviso do Fabricante
• https://vuldb.com/vuln/354156 · Nota
• https://twitter.com/CVEnew/status/2039004522006085688 · Publicação no Twitter
• https://ubuntu.com/security/CVE-2026-5124 · Aviso do Fabricante
• https://github.com/osrg/gobgp · Nota
• https://vuldb.com/vuln/354156/cti · Nota