Vulnerability · Published Jul 12, 2025 · Assigned by VulDB
CVE-2025-7464osrg GoBGP rtr.go SplitRTR out-of-bounds
Low 3.7
In plain English
A low-severity out-of-bounds read in GoBGP from osrg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | gobgp | no fix listed | DEBIAN-CVE-2025-7464 |
| Debian:13 | gobgp | no fix listed | DEBIAN-CVE-2025-7464 |
| Debian:14 | gobgp | 4.3.0-1 | DEBIAN-CVE-2025-7464 |
| Ubuntu:25.10 | gobgp | no fix listed | UBUNTU-CVE-2025-7464 |
| Ubuntu:26.10 | gobgp | no fix listed | UBUNTU-CVE-2025-7464 |
Affected products (as reported)
Weakness: CWE-125, CWE-119 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
References
- VDB-316116 | osrg GoBGP rtr.go SplitRTR out-of-bounds vdb-entry, technical-description
- VDB-316116 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- Submit #610193 | NTT Open Source GoBGP defe9ac1b1f1c854d1941a5b70dee3aaed6fb960 Out-of-Bounds Read third-party-advisory
- https://github.com/osrg/gobgp/commit/e748f43496d74946d14fed85c776452e47b99d64 patch