CVE-2025-43970: gobgp
CVSS: 5.3v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2025-43970DEBIAN-CVE-2025-43970GHSA-hqhq-hp5x-xp3wGO-2025-3630CGA-3692-mm35-pfr3CGA-36f4-f6xr-2c38CGA-3c5x-w9g9-27q9CGA-45pv-h2p2-47q5CGA-46pv-4935-ppwvCGA-4g8j-9vvw-rxfwCGA-5cjx-p6vp-v585CGA-5pj2-jmxg-rw24CGA-6873-546c-gmgwCGA-6cxc-hmjq-4g6hCGA-6r5w-vg2j-fr8qCGA-6rh3-8pfv-wvg5CGA-7j3w-w8x8-23gpCGA-7q38-qv78-3w9fCGA-7r4v-93qx-m7xfCGA-87hp-qfw6-gmwjCGA-c4j3-v84f-x5xhCGA-cx46-m275-qwq9CGA-fm6g-85xg-v5qfCGA-fwvm-fvjv-35wxCGA-jcv6-pwgc-j9xcCGA-m3v7-gqh3-rhwqCGA-mv24-crf6-pqr4CGA-mvmf-cchj-fc32CGA-p4w6-cr6p-2gvmCGA-pj94-8jg9-7vxqCGA-pmvx-5m2x-rrvhCGA-qg8f-vjpm-f7jgCGA-r5x6-78pf-5r8vCGA-rjh7-c87p-38vjCGA-rmw3-pf4g-9w75CGA-v529-f7mw-5623CGA-v7mc-wfmr-3crrCGA-vpxv-8xx2-gg2fCGA-vvpq-5cwf-64ghCGA-w33h-rj42-vprgCGA-wq33-58ww-m4wwCGA-x77x-v9fh-wcwq
Published 21-04-2025Last modified 21-04-2025
Vulnerability summary
CVE-2025-43970 is a medium (CVSS 5.3) vulnerability in gobgp. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 35.2% of scored vulnerabilities.
CVSS score
5.3/10
010
Medium · v3.1 (NVD)EPSS score
0.42%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 4Timeline
- 21-04-2025PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).
CVSS metrics
6 scores · 6 sources · 1 versionMedium 5.3Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LSources6 sources · 4.3–5.3
- CVE.orgCNA4.3MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- OSV · GoEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:LDiffers
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
0.00 pp
From 0.42% on 19-09-2026
19-09-202619-10-2026
EPSS score0.42%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard19 products
- cilium-1.15< 1.15.19-r3
- cilium-1.16< 1.16.9-r1
- cilium-1.16-clustermesh-apiserver< 1.16.9-r1
- cilium-1.16-container-init< 1.16.9-r1
- cilium-1.16-container-init-compat< 1.16.9-r1
Debian1 product
- gobgpAll versions (No fix recorded) | < 3.35.0-1
Github.com/osrg1 product
- gobgpAll versions (No fix recorded)
Github.com/osrg/gobgp1 product
- v3< 3.35.0
Gobgp1 product
- gobgp< 3.35.0
Osrg1 product
- gobgp< 3.35.0
Ubuntu1 product
- gobgp< 1.29-1ubuntu0.1+esm1 | < 2.12.0-1ubuntu0.1~esm2 | < 2.25.0-3ubuntu0.1+esm2 | < 3.23.0-1ubuntu0.3+esm2
7 vendors · 25 products
References
10 links
- github.com/osrg/gobgpPACKAGE