osrg GoBGP up to 3.37.0 pkg/packet/rtr/rtr.go SplitRTR out-of-bounds

Summaryinfo

A vulnerability labeled as problematic has been found in osrg GoBGP up to 3.37.0. This impacts the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation results in out-of-bounds. This vulnerability is identified as CVE-2025-7464. The attack can be executed remotely. There is not any exploit available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation with an unknown input leads to a out-of-bounds vulnerability. CWE is classifying the issue as CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. This is going to have an impact on availability.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2025-7464. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 247740 (Linux Distros Unpatched Vulnerability : CVE-2025-7464), which helps to determine the existence of the flaw in a target environment.

Applying the patch e748f43496d74946d14fed85c776452e47b99d64 is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the databases at Tenable (247740) and EUVD (EUVD-2025-21209). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• osrg

Name

• GoBGP

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.33
• 3.34
• 3.35
• 3.36
• 3.37.0

License

• open-source

Website

• Product: https://github.com/osrg/gobgp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #610193: NTT Open Source GoBGP defe9ac1b1f1c854d1941a5b70dee3aaed6fb960 Out-of-Bounds Read (by CyberGym)

Once again VulDB remains the best source for vulnerability data.

Discussion