Log in Start free

Vulnerability · Published Mar 30, 2026 · Assigned by VulDB

CVE-2026-5122osrg GoBGP BGP OPEN Message bgp.go DecodeFromBytes access control

Low 3.7

In plain English

A low-severity improper access control in GoBGP from osrg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.3%top 77.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in osrg GoBGP up to 4.3.0. This affects the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP OPEN Message Handler. Performing a manipulation of the argument domainNameLen results in improper access controls. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The patch is named 2b09db390a3d455808363c53e409afe6b1b86d2d. It is suggested to install a patch to address this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12gobgpno fix listedDEBIAN-CVE-2026-5122
Debian:13gobgpno fix listedDEBIAN-CVE-2026-5122
Debian:14gobgp4.4.0-1DEBIAN-CVE-2026-5122
Ubuntu:25.10gobgpno fix listedUBUNTU-CVE-2026-5122
Ubuntu:26.10gobgpno fix listedUBUNTU-CVE-2026-5122

Affected products (as reported)

VendorProductVersions
osrg GoBGP 4.04.14.24.3.0

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

References