GoBGP up to 3.34.x RTR Message pkg/packet/rtr/rtr.go memory corruption

Summaryinfo

A vulnerability classified as critical was found in GoBGP up to 3.34.x. This issue affects some unknown processing of the file pkg/packet/rtr/rtr.go of the component RTR Message Handler. The manipulation results in memory corruption. This vulnerability is known as CVE-2025-43973. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in GoBGP up to 3.34.x. Affected is an unknown function of the file pkg/packet/rtr/rtr.go of the component RTR Message Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-43973 since 04/21/2025. The exploitability is told to be easy. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 242574 (Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : GoBGP vulnerabilities (USN-7661-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.35.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (242574) and EUVD (EUVD-2025-12347). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• GoBGP

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion