CVE-2025-43971: gobgp Off-by-one Error
CVSS: 8.6v3.1HighAnalyzed
AliasesUBUNTU-CVE-2025-43971DEBIAN-CVE-2025-43971GHSA-7m35-vw2c-696vGO-2025-3631CGA-2hf4-7fr7-g3hmCGA-2j9w-q527-89vvCGA-35v4-mgq2-w8ggCGA-3q99-p2w8-pg8pCGA-3qmc-v373-jw3gCGA-3rjx-qppq-x9c2CGA-4mxv-48f4-2hv7CGA-4p6f-gh2c-8x3fCGA-4p79-cq75-jw69CGA-5p9c-35mr-jfvqCGA-5w8x-g22j-pf42CGA-5xwh-cgrj-xm6vCGA-65c2-2w48-hq34CGA-66hg-fcg2-chj7CGA-6grv-hwpv-fmgrCGA-72jw-vhg4-46hmCGA-7j2m-gq32-j8p2CGA-7v29-g2qc-rfqhCGA-7xv5-h75f-hfj9CGA-9q89-6vr2-r368CGA-c536-37mp-2vw4CGA-f2gf-3473-vcjrCGA-fcrr-6gmw-fcr5CGA-grxh-vx8f-x5fmCGA-gvxv-2wcp-2953CGA-j454-h5h7-7cfqCGA-jwmr-293g-5363CGA-mgj6-922h-g8gjCGA-p36f-wf43-c5qvCGA-pxr7-mg46-469vCGA-q269-933p-67j2CGA-qf78-53pw-24vrCGA-qmcm-w74g-v4g5CGA-rwr2-mxj6-63p5CGA-rx88-4729-m526CGA-vhc8-4w97-m985CGA-vm6h-6jx6-388mCGA-xr24-ppfh-m2c9
Published 21-04-2025Last modified 21-04-2025
Vulnerability summary
CVE-2025-43971 is a high (CVSS 8.6) Off-by-one Error vulnerability in gobgp. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.5% of scored vulnerabilities.
CVSS score
8.6/10
010
High · v3.1 (CVE.org)EPSS score
0.55%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 4Timeline
- 21-04-2025PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen.
CVSS metrics
6 scores · 6 sources · 1 versionHigh 8.6Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HSources6 sources · 7.5–8.6
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · GoEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
0.00 pp
From 0.55% on 19-09-2026
19-09-202619-10-2026
EPSS score0.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard19 products
- cilium-1.15< 1.15.19-r3
- cilium-1.16< 1.16.9-r1
- cilium-1.16-clustermesh-apiserver< 1.16.9-r1
- cilium-1.16-container-init< 1.16.9-r1
- cilium-1.16-container-init-compat< 1.16.9-r1
Debian1 product
- gobgpAll versions (No fix recorded) | < 3.35.0-1
Github.com/osrg1 product
- gobgpAll versions (No fix recorded)
Github.com/osrg/gobgp1 product
- v3≥ 3.11.0, < 3.35.0 | < 3.35.0
Gobgp1 product
- gobgp< 3.35.0
Osrg1 product
- gobgp< 3.35.0
Ubuntu1 product
- gobgp< 3.23.0-1ubuntu0.3+esm2
7 vendors · 25 products
References
10 links
- github.com/osrg/gobgpPACKAGE