CVE-2025-43973: gobgp Off-by-one Error
CVSS: 9.8v3.1CriticalAnalyzed
AliasesUBUNTU-CVE-2025-43973DEBIAN-CVE-2025-43973GHSA-c5jg-wr5v-2wp2GO-2025-3633CGA-24cq-wx4x-mf8jCGA-2g5m-qfcr-3vxgCGA-2hcq-px5f-7mg7CGA-2hgp-frv7-8r9wCGA-3mpv-5jhv-5923CGA-47q4-47gv-jcr2CGA-5gvj-qxrw-pm2rCGA-6xqf-72fm-7238CGA-8j6p-w3mr-m5g5CGA-8v45-67vp-6f73CGA-98rq-9p74-h5gxCGA-9vcp-cpmw-76whCGA-9vx3-rm6p-h2ccCGA-c553-xq8r-8wxgCGA-ch7j-887m-8cx9CGA-cqvg-hc6g-qrmqCGA-f3q9-9hj6-7r64CGA-f6fp-m665-vrwmCGA-gpq9-83hf-4663CGA-hjjw-2c3c-mxfxCGA-hmg7-gmv9-8f49CGA-j2vg-3gvq-5289CGA-j5p7-hwrf-6447CGA-jf7j-3w7v-g4q6CGA-jrgg-994x-wh2qCGA-jwp5-vfqg-57wqCGA-mp2h-w8mq-g258CGA-mp85-mm3r-phc6CGA-q972-f6p8-7r6mCGA-r52h-pvf2-849rCGA-r5qm-pvmr-c84jCGA-rm6c-gjc2-2crxCGA-rqcc-w22m-h3x5CGA-w254-8hgj-x4rvCGA-w83m-w36x-6p2jCGA-whv7-fg9f-c999CGA-wwhv-h95q-68x2CGA-x4gf-6g24-8rj7
Published 21-04-2025Last modified 21-04-2025
Vulnerability summary
CVE-2025-43973 is a critical (CVSS 9.8) Off-by-one Error vulnerability in gobgp. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 45.7% of scored vulnerabilities.
CVSS score
9.8/10
010
Critical · v3.1 (NVD)EPSS score
0.56%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 4Timeline
- 21-04-2025PublishedVulnerability first disclosed.
- 21-04-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message.
CVSS metrics
6 scores · 6 sources · 1 versionCritical 9.8Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSources6 sources · 6.8–9.8
- CVE.orgCNA6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · GoEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:HDiffers
EPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
46%
Versus all other CVEs
30-day change
0.00 pp
From 0.56% on 19-09-2026
19-09-202619-10-2026
EPSS score0.56%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard19 products
- cilium-1.15< 1.15.19-r3
- cilium-1.16< 1.16.9-r1
- cilium-1.16-clustermesh-apiserver< 1.16.9-r1
- cilium-1.16-container-init< 1.16.9-r1
- cilium-1.16-container-init-compat< 1.16.9-r1
Debian1 product
- gobgpAll versions (No fix recorded) | < 3.35.0-1
Github.com/osrg1 product
- gobgpAll versions (No fix recorded)
Github.com/osrg/gobgp1 product
- v3< 3.35.0
Gobgp1 product
- gobgp< 3.35.0
Osrg1 product
- gobgp< 3.35.0
Ubuntu1 product
- gobgp< 1.29-1ubuntu0.1+esm1 | < 2.12.0-1ubuntu0.1~esm2 | < 2.25.0-3ubuntu0.1+esm2 | < 3.23.0-1ubuntu0.3+esm2
7 vendors · 25 products
References
10 links
- github.com/osrg/gobgpPACKAGE