PT-2026-29046 · Osrg · Gobgp

Sunxj · Published 2026-03-30 · Updated 2026-03-30 · CVE-2026-5123

NVD

CVSS v2.0

2.6

Low

AV:N/AC:H/Au:N/C:N/I:N/A:P

A weakness has been identified in osrg GoBGP up to 4.3.0. This impacts the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go. Executing a manipulation of the argument data[1] can lead to off-by-one. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is said to be difficult. This patch is called 67c059413470df64bc20801c46f64058e88f800f. A patch should be applied to remediate this issue.

Fix

Weakness Enumeration

CWE-189

CWE-193

Related Identifiers

CVE-2026-5123

Affected Products

Gobgp

References · 7

• https://github.com/osrg/gobgp/pull/3342 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5123 · Security Note
• https://github.com/osrg/gobgp/commit/67c059413470df64bc20801c46f64058e88f800f · Patch
• https://vuldb.com/submit/780179 · Note
• https://vuldb.com/vuln/354155 · Note
• https://github.com/osrg/gobgp · Note
• https://vuldb.com/vuln/354155/cti · Note