Log in Start free

Vulnerability · Published Mar 30, 2026 · Assigned by VulDB

CVE-2026-5124osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control

Low 3.7

In plain English

A low-severity improper access control in GoBGP from osrg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.3%top 77.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in osrg GoBGP up to 4.3.0. Affected is the function BGPHeader.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP Header Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is told to be difficult. The identifier of the patch is f0f24a2a901cbf159260698211ab15c583ced131. To fix this issue, it is recommended to deploy a patch.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12gobgpno fix listedDEBIAN-CVE-2026-5124
Debian:13gobgpno fix listedDEBIAN-CVE-2026-5124
Debian:14gobgp4.4.0-1DEBIAN-CVE-2026-5124
Ubuntu:25.10gobgpno fix listedUBUNTU-CVE-2026-5124
Ubuntu:26.10gobgpno fix listedUBUNTU-CVE-2026-5124

Affected products (as reported)

VendorProductVersions
osrg GoBGP 4.04.14.24.3.0

Weakness: CWE-284, CWE-266 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C

References