PT-2026-29060 · Osrg · Gobgp

Sunxj · Published 2026-01-01 · Updated 2026-03-31 · CVE-2026-5124

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions osrg GoBGP versions through 4.3.0

Description A security issue has been identified in osrg GoBGP. The BGPHeader.DecodeFromBytes function within the BGP Header Handler component, located in the file pkg/packet/bgp/bgp.go, is susceptible to improper access controls. Remote exploitation is possible, and the attack is considered to have high complexity with difficult exploitability.

Recommendations Deploy the patch with identifier f0f24a2a901cbf159260698211ab15c583ced131.

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2026-5124

Affected Products

Gobgp

References · 14

• https://github.com/osrg/gobgp/pull/3340 · Patch
• https://github.com/osrg/gobgp/commit/f0f24a2a901cbf159260698211ab15c583ced131 · Patch
• https://ubuntu.com/security/CVE-2026-5124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5124 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-5124 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5124 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5124 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5124 · Vendor Advisory
• https://vuldb.com/submit/780189 · Note
• https://vuldb.com/vuln/354156 · Note
• https://vuldb.com/vuln/354156/cti · Note
• https://twitter.com/CVEnew/status/2039004522006085688 · Twitter Post
• https://github.com/osrg/gobgp · Note
• https://twitter.com/infoflowcloud/status/2039006487876346162 · Twitter Post