Vulnerability Details CVE-2026-5123
A weakness has been identified in osrg GoBGP up to 4.3.0. This impacts the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go. Executing a manipulation of the argument data[1] can lead to off-by-one. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is said to be difficult. This patch is called 67c059413470df64bc20801c46f64058e88f800f. A patch should be applied to remediate this issue.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 19.1%
CVSS Severity
CVSS v3 Score 3.7
CVSS v2 Score 2.6
Products affected by CVE-2026-5123
-
-
-
cpe:2.3:a:osrg:gobgp:1.10
-
cpe:2.3:a:osrg:gobgp:1.11
-
cpe:2.3:a:osrg:gobgp:1.12
-
cpe:2.3:a:osrg:gobgp:1.13
-
cpe:2.3:a:osrg:gobgp:1.14
-
cpe:2.3:a:osrg:gobgp:1.15
-
cpe:2.3:a:osrg:gobgp:1.16
-
cpe:2.3:a:osrg:gobgp:1.17
-
cpe:2.3:a:osrg:gobgp:1.18
-
cpe:2.3:a:osrg:gobgp:1.19
-
-
cpe:2.3:a:osrg:gobgp:1.20
-
cpe:2.3:a:osrg:gobgp:1.21
-
cpe:2.3:a:osrg:gobgp:1.22
-
cpe:2.3:a:osrg:gobgp:1.23
-
cpe:2.3:a:osrg:gobgp:1.24
-
cpe:2.3:a:osrg:gobgp:1.25
-
cpe:2.3:a:osrg:gobgp:1.26
-
cpe:2.3:a:osrg:gobgp:1.27
-
cpe:2.3:a:osrg:gobgp:1.28
-
cpe:2.3:a:osrg:gobgp:1.29
-
-
cpe:2.3:a:osrg:gobgp:1.30
-
cpe:2.3:a:osrg:gobgp:1.31
-
cpe:2.3:a:osrg:gobgp:1.32
-
cpe:2.3:a:osrg:gobgp:1.33
-
-
-
-
-
-
-
cpe:2.3:a:osrg:gobgp:2.0.0
-
cpe:2.3:a:osrg:gobgp:2.1.0
-
cpe:2.3:a:osrg:gobgp:2.10.0
-
cpe:2.3:a:osrg:gobgp:2.11.0
-
cpe:2.3:a:osrg:gobgp:2.12.0
-
cpe:2.3:a:osrg:gobgp:2.13.0
-
cpe:2.3:a:osrg:gobgp:2.14.0
-
cpe:2.3:a:osrg:gobgp:2.15.0
-
cpe:2.3:a:osrg:gobgp:2.16.0
-
cpe:2.3:a:osrg:gobgp:2.17.0
-
cpe:2.3:a:osrg:gobgp:2.18.0
-
cpe:2.3:a:osrg:gobgp:2.19.0
-
cpe:2.3:a:osrg:gobgp:2.2.0
-
cpe:2.3:a:osrg:gobgp:2.20.0
-
cpe:2.3:a:osrg:gobgp:2.21.0
-
cpe:2.3:a:osrg:gobgp:2.22.0
-
cpe:2.3:a:osrg:gobgp:2.23.0
-
cpe:2.3:a:osrg:gobgp:2.24.0
-
cpe:2.3:a:osrg:gobgp:2.25.0
-
cpe:2.3:a:osrg:gobgp:2.26.0
-
cpe:2.3:a:osrg:gobgp:2.27.0
-
cpe:2.3:a:osrg:gobgp:2.28.0
-
cpe:2.3:a:osrg:gobgp:2.29.0
-
cpe:2.3:a:osrg:gobgp:2.3.0
-
cpe:2.3:a:osrg:gobgp:2.30.0
-
cpe:2.3:a:osrg:gobgp:2.31.0
-
cpe:2.3:a:osrg:gobgp:2.32.0
-
cpe:2.3:a:osrg:gobgp:2.33.0
-
cpe:2.3:a:osrg:gobgp:2.34.0
-
cpe:2.3:a:osrg:gobgp:2.4.0
-
cpe:2.3:a:osrg:gobgp:2.5.0
-
cpe:2.3:a:osrg:gobgp:2.6.0
-
cpe:2.3:a:osrg:gobgp:2.7.0
-
cpe:2.3:a:osrg:gobgp:2.8.0
-
cpe:2.3:a:osrg:gobgp:2.9.0
-
cpe:2.3:a:osrg:gobgp:3.0.0
-
cpe:2.3:a:osrg:gobgp:3.1.0
-
cpe:2.3:a:osrg:gobgp:3.10.0
-
cpe:2.3:a:osrg:gobgp:3.11.0
-
cpe:2.3:a:osrg:gobgp:3.12.0
-
cpe:2.3:a:osrg:gobgp:3.13.0
-
cpe:2.3:a:osrg:gobgp:3.14.0
-
cpe:2.3:a:osrg:gobgp:3.15.0
-
cpe:2.3:a:osrg:gobgp:3.16.0
-
cpe:2.3:a:osrg:gobgp:3.17.0
-
cpe:2.3:a:osrg:gobgp:3.18.0
-
cpe:2.3:a:osrg:gobgp:3.19.0
-
cpe:2.3:a:osrg:gobgp:3.2.0
-
cpe:2.3:a:osrg:gobgp:3.20.0
-
cpe:2.3:a:osrg:gobgp:3.21.0
-
cpe:2.3:a:osrg:gobgp:3.22.0
-
cpe:2.3:a:osrg:gobgp:3.23.0
-
cpe:2.3:a:osrg:gobgp:3.24.0
-
cpe:2.3:a:osrg:gobgp:3.25.0
-
cpe:2.3:a:osrg:gobgp:3.26.0
-
cpe:2.3:a:osrg:gobgp:3.27.0
-
cpe:2.3:a:osrg:gobgp:3.28.0
-
cpe:2.3:a:osrg:gobgp:3.29.0
-
cpe:2.3:a:osrg:gobgp:3.3.0
-
cpe:2.3:a:osrg:gobgp:3.30.0
-
cpe:2.3:a:osrg:gobgp:3.31.0
-
cpe:2.3:a:osrg:gobgp:3.32.0
-
cpe:2.3:a:osrg:gobgp:3.33.0
-
cpe:2.3:a:osrg:gobgp:3.34.0
-
cpe:2.3:a:osrg:gobgp:3.35.0
-
cpe:2.3:a:osrg:gobgp:3.36.0
-
cpe:2.3:a:osrg:gobgp:3.4.0
-
cpe:2.3:a:osrg:gobgp:3.5.0
-
cpe:2.3:a:osrg:gobgp:3.6.0
-
cpe:2.3:a:osrg:gobgp:3.7.0
-
cpe:2.3:a:osrg:gobgp:3.8.0
-
cpe:2.3:a:osrg:gobgp:3.9.0