Vulnerability Details CVE-2026-5122
A security flaw has been discovered in osrg GoBGP up to 4.3.0. This affects the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP OPEN Message Handler. Performing a manipulation of the argument domainNameLen results in improper access controls. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The patch is named 2b09db390a3d455808363c53e409afe6b1b86d2d. It is suggested to install a patch to address this issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 13.5%
CVSS Severity
CVSS v3 Score 3.7
CVSS v2 Score 2.6
Products affected by CVE-2026-5122
-
-
-
cpe:2.3:a:osrg:gobgp:1.10
-
cpe:2.3:a:osrg:gobgp:1.11
-
cpe:2.3:a:osrg:gobgp:1.12
-
cpe:2.3:a:osrg:gobgp:1.13
-
cpe:2.3:a:osrg:gobgp:1.14
-
cpe:2.3:a:osrg:gobgp:1.15
-
cpe:2.3:a:osrg:gobgp:1.16
-
cpe:2.3:a:osrg:gobgp:1.17
-
cpe:2.3:a:osrg:gobgp:1.18
-
cpe:2.3:a:osrg:gobgp:1.19
-
-
cpe:2.3:a:osrg:gobgp:1.20
-
cpe:2.3:a:osrg:gobgp:1.21
-
cpe:2.3:a:osrg:gobgp:1.22
-
cpe:2.3:a:osrg:gobgp:1.23
-
cpe:2.3:a:osrg:gobgp:1.24
-
cpe:2.3:a:osrg:gobgp:1.25
-
cpe:2.3:a:osrg:gobgp:1.26
-
cpe:2.3:a:osrg:gobgp:1.27
-
cpe:2.3:a:osrg:gobgp:1.28
-
cpe:2.3:a:osrg:gobgp:1.29
-
-
cpe:2.3:a:osrg:gobgp:1.30
-
cpe:2.3:a:osrg:gobgp:1.31
-
cpe:2.3:a:osrg:gobgp:1.32
-
cpe:2.3:a:osrg:gobgp:1.33
-
-
-
-
-
-
-
cpe:2.3:a:osrg:gobgp:2.0.0
-
cpe:2.3:a:osrg:gobgp:2.1.0
-
cpe:2.3:a:osrg:gobgp:2.10.0
-
cpe:2.3:a:osrg:gobgp:2.11.0
-
cpe:2.3:a:osrg:gobgp:2.12.0
-
cpe:2.3:a:osrg:gobgp:2.13.0
-
cpe:2.3:a:osrg:gobgp:2.14.0
-
cpe:2.3:a:osrg:gobgp:2.15.0
-
cpe:2.3:a:osrg:gobgp:2.16.0
-
cpe:2.3:a:osrg:gobgp:2.17.0
-
cpe:2.3:a:osrg:gobgp:2.18.0
-
cpe:2.3:a:osrg:gobgp:2.19.0
-
cpe:2.3:a:osrg:gobgp:2.2.0
-
cpe:2.3:a:osrg:gobgp:2.20.0
-
cpe:2.3:a:osrg:gobgp:2.21.0
-
cpe:2.3:a:osrg:gobgp:2.22.0
-
cpe:2.3:a:osrg:gobgp:2.23.0
-
cpe:2.3:a:osrg:gobgp:2.24.0
-
cpe:2.3:a:osrg:gobgp:2.25.0
-
cpe:2.3:a:osrg:gobgp:2.26.0
-
cpe:2.3:a:osrg:gobgp:2.27.0
-
cpe:2.3:a:osrg:gobgp:2.28.0
-
cpe:2.3:a:osrg:gobgp:2.29.0
-
cpe:2.3:a:osrg:gobgp:2.3.0
-
cpe:2.3:a:osrg:gobgp:2.30.0
-
cpe:2.3:a:osrg:gobgp:2.31.0
-
cpe:2.3:a:osrg:gobgp:2.32.0
-
cpe:2.3:a:osrg:gobgp:2.33.0
-
cpe:2.3:a:osrg:gobgp:2.34.0
-
cpe:2.3:a:osrg:gobgp:2.4.0
-
cpe:2.3:a:osrg:gobgp:2.5.0
-
cpe:2.3:a:osrg:gobgp:2.6.0
-
cpe:2.3:a:osrg:gobgp:2.7.0
-
cpe:2.3:a:osrg:gobgp:2.8.0
-
cpe:2.3:a:osrg:gobgp:2.9.0
-
cpe:2.3:a:osrg:gobgp:3.0.0
-
cpe:2.3:a:osrg:gobgp:3.1.0
-
cpe:2.3:a:osrg:gobgp:3.10.0
-
cpe:2.3:a:osrg:gobgp:3.11.0
-
cpe:2.3:a:osrg:gobgp:3.12.0
-
cpe:2.3:a:osrg:gobgp:3.13.0
-
cpe:2.3:a:osrg:gobgp:3.14.0
-
cpe:2.3:a:osrg:gobgp:3.15.0
-
cpe:2.3:a:osrg:gobgp:3.16.0
-
cpe:2.3:a:osrg:gobgp:3.17.0
-
cpe:2.3:a:osrg:gobgp:3.18.0
-
cpe:2.3:a:osrg:gobgp:3.19.0
-
cpe:2.3:a:osrg:gobgp:3.2.0
-
cpe:2.3:a:osrg:gobgp:3.20.0
-
cpe:2.3:a:osrg:gobgp:3.21.0
-
cpe:2.3:a:osrg:gobgp:3.22.0
-
cpe:2.3:a:osrg:gobgp:3.23.0
-
cpe:2.3:a:osrg:gobgp:3.24.0
-
cpe:2.3:a:osrg:gobgp:3.25.0
-
cpe:2.3:a:osrg:gobgp:3.26.0
-
cpe:2.3:a:osrg:gobgp:3.27.0
-
cpe:2.3:a:osrg:gobgp:3.28.0
-
cpe:2.3:a:osrg:gobgp:3.29.0
-
cpe:2.3:a:osrg:gobgp:3.3.0
-
cpe:2.3:a:osrg:gobgp:3.30.0
-
cpe:2.3:a:osrg:gobgp:3.31.0
-
cpe:2.3:a:osrg:gobgp:3.32.0
-
cpe:2.3:a:osrg:gobgp:3.33.0
-
cpe:2.3:a:osrg:gobgp:3.34.0
-
cpe:2.3:a:osrg:gobgp:3.35.0
-
cpe:2.3:a:osrg:gobgp:3.36.0
-
cpe:2.3:a:osrg:gobgp:3.4.0
-
cpe:2.3:a:osrg:gobgp:3.5.0
-
cpe:2.3:a:osrg:gobgp:3.6.0
-
cpe:2.3:a:osrg:gobgp:3.7.0
-
cpe:2.3:a:osrg:gobgp:3.8.0
-
cpe:2.3:a:osrg:gobgp:3.9.0