PT-2026-29046 · Osrg · Gobgp

Sunxj · Published 2026-01-01 · Updated 2026-03-31 · CVE-2026-5123

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions osrg GoBGP versions through 4.3.0

Description A weakness exists in the DecodeFromBytes function within the pkg/packet/bgp/bgp.go file of osrg GoBGP. Manipulating the data[1] argument can lead to an off-by-one error. The attack can be launched remotely and is considered highly complex with difficult exploitability. The identified patch is 67c059413470df64bc20801c46f64058e88f800f.

Recommendations Apply the patch 67c059413470df64bc20801c46f64058e88f800f to address the issue.

Fix

Weakness Enumeration

CWE-193

CWE-189

Related Identifiers

CVE-2026-5123

Affected Products

Gobgp

References · 14

• https://github.com/osrg/gobgp/pull/3342 · Patch
• https://github.com/osrg/gobgp/commit/67c059413470df64bc20801c46f64058e88f800f · Patch
• https://cve.org/CVERecord?id=CVE-2026-5123 · Security Note
• https://ubuntu.com/security/CVE-2026-5123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5123 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5123 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5123 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5123 · Vendor Advisory
• https://vuldb.com/vuln/354155/cti · Note
• https://vuldb.com/submit/780179 · Note
• https://twitter.com/CVEnew/status/2039004528415023537 · Twitter Post
• https://github.com/osrg/gobgp · Note
• https://vuldb.com/vuln/354155 · Note
• https://twitter.com/infoflowcloud/status/2039006802885456040 · Twitter Post