CVE-2025-43972

Description

An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context.

Reserved 2025-04-21 | Published 2025-04-21 | Updated 2025-04-21 | Assigner mitre

Problem types

CWE-1284 Improper Validation of Specified Quantity in Input

Product status

Default status
unaffected

Any version before 3.35.0
affected

References

github.com/osrg/gobgp/compare/v3.34.0...v3.35.0

github.com/...ommit/ca7383f450f7b296c5389feceef2467de5ab6e5a

cve.org (CVE-2025-43972)

nvd.nist.gov (CVE-2025-43972)

Download JSON