CVE-2026-5122

NameCVE-2026-5122
DescriptionA security flaw has been discovered in osrg GoBGP up to 4.3.0. This affects the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP OPEN Message Handler. Performing a manipulation of the argument domainNameLen results in improper access controls. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The patch is named 2b09db390a3d455808363c53e409afe6b1b86d2d. It is suggested to install a patch to address this issue.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
gobgp (PTS)bullseye2.25.0-2vulnerable
bookworm3.10.0-1vulnerable
trixie3.36.0-2vulnerable
forky, sid4.3.0-1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
gobgpsource(unstable)(unfixed)

Notes

https://github.com/osrg/gobgp/pull/3343
Fixed by; https://github.com/osrg/gobgp/commit/2b09db390a3d455808363c53e409afe6b1b86d2d

Search for package or bug name: Reporting problems