PT-2026-29028 · Osrg · Gobgp

Rensiru · Published 2026-03-30 · Updated 2026-03-30 · CVE-2026-5122

NVD

CVSS v2.0

2.6

Low

AV:N/AC:H/Au:N/C:N/I:P/A:N

A security flaw has been discovered in osrg GoBGP up to 4.3.0. This affects the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP OPEN Message Handler. Performing a manipulation of the argument domainNameLen results in improper access controls. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The patch is named 2b09db390a3d455808363c53e409afe6b1b86d2d. It is suggested to install a patch to address this issue.

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2026-5122

Affected Products

Gobgp

References · 7

• https://github.com/osrg/gobgp/commit/2b09db390a3d455808363c53e409afe6b1b86d2d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5122 · Security Note
• https://github.com/osrg/gobgp/pull/3343 · Patch
• https://vuldb.com/vuln/354154 · Note
• https://vuldb.com/vuln/354154/cti · Note
• https://vuldb.com/submit/780124 · Note
• https://github.com/osrg/gobgp · Note