CVE-2025-43972: GoBGP Flowspec Parser Crash Vulnerability
Summary
CVE-2025-43972: GoBGP crashes in the flowspec parser. Affected versions are not published. No fix is published. How to fix ↓
Also tracked for
- gobgp · Debian:11
The same CVE-2025-43972 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) written in Go. It is designed to provide a flexible and extensible platform for BGP routing, enabling users to manage and control their network routing policies effectively. The package supports various BGP features, including flowspec, which allows for the specification of traffic filtering rules. However, prior to version 3.35.0, GoBGP is vulnerable to a crash when processing flowspec messages due to improper handling of input data.
Vulnerability Detail
An issue was discovered in GoBGP before version 3.35.0, where an attacker can exploit the flowspec parser in the pkg/packet/bgp/bgp.go file. By sending fewer than 20 bytes of data in a specific context, an attacker can trigger a crash in the application. This vulnerability can lead to denial of service, impacting the availability of the BGP service and potentially disrupting network operations.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can implement input validation to ensure that the data sent to the flowspec parser meets the expected length requirements. However, this is not a substitute for updating to the patched version.
Conclusion
In summary, the GoBGP package is vulnerable to a crash due to improper handling of flowspec messages in versions prior to 3.35.0. It is crucial to update to the patched version to mitigate the risk of denial of service attacks. Utilizing tools like Vulert can further enhance your security posture by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for github.com/osrg/gobgp →
FAQ
The vulnerability has a CVSS score of 6.8, indicating a moderate severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If left unaddressed, this vulnerability could allow an attacker to crash the GoBGP application, leading to potential denial of service and disruption of network services.
Yes, version 3.35.0 and later of GoBGP are safe to use as they contain the necessary fixes for this vulnerability.
Vulert is a monitoring tool that uses Gopkg.lock to track and alert in real-time for open-source vulnerabilities in your software, helping you maintain security without needing access to the code.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/osrg/gobgp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
