PT-2026-29060 · Osrg · Gobgp

Sunxj · CVE-2026-5124 · Published 2026-01-01 · Updated 2026-03-31

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

Name of the Vulnerable Software and Affected Versions osrg GoBGP versions through 4.3.0

Description A security issue has been identified in osrg GoBGP. The BGPHeader.DecodeFromBytes function within the BGP Header Handler component, located in the file pkg/packet/bgp/bgp.go, is susceptible to improper access controls. Remote exploitation is possible, and the attack is considered to have high complexity with difficult exploitability.

Recommendations Deploy the patch with identifier f0f24a2a901cbf159260698211ab15c583ced131.

Exploit

Fix

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

Related Identifiers

CVE-2026-5124

Affected Products

Gobgp

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5124.json · Exploit
• https://github.com/osrg/gobgp/pull/3340 · Patch
• https://github.com/osrg/gobgp/commit/f0f24a2a901cbf159260698211ab15c583ced131 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5124 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5124 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-5124 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5124 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5124 · Security Note
• https://osv.dev/vulnerability/CVE-2026-5124 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5124 · Security Note
• https://vuldb.com/vuln/354156 · Note
• https://github.com/osrg/gobgp · Note
• https://vuldb.com/submit/780189 · Note
• https://twitter.com/infoflowcloud/status/2039006487876346162 · Twitter Post
• https://twitter.com/CVEnew/status/2039004522006085688 · Twitter Post