PT-2026-29028 · Osrg · Gobgp

Rensiru · Published 2026-01-01 · Updated 2026-04-08 · CVE-2026-5122

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions osrg GoBGP versions through 4.3.0

Description A security issue exists in osrg GoBGP up to version 4.3.0. The issue resides in the DecodeFromBytes function within the pkg/packet/bgp/bgp.go file, specifically in the BGP OPEN Message Handler component. Manipulation of the domainNameLen argument can lead to improper access controls. The attack can be initiated remotely and requires a high degree of complexity, with exploitability reported as difficult.

Recommendations Install the patch 2b09db390a3d455808363c53e409afe6b1b86d2d to address this issue.

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2026-5122

Affected Products

Gobgp

References · 15

• https://github.com/osrg/gobgp/pull/3343 · Patch
• https://github.com/osrg/gobgp/commit/2b09db390a3d455808363c53e409afe6b1b86d2d · Patch
• https://ubuntu.com/security/CVE-2026-5122 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5122 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5122 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5122 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-5122 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5122 · Vendor Advisory
• https://vuldb.com/submit/780124 · Note
• https://t.me/cveNotify/158469 · Telegram Post
• https://vuldb.com/vuln/354154 · Note
• https://twitter.com/infoflowcloud/status/2039007086869123421 · Twitter Post
• https://vuldb.com/vuln/354154/cti · Note
• https://github.com/osrg/gobgp · Note
• https://twitter.com/CVEnew/status/2039004532458373147 · Twitter Post