An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family).

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2025-43970 · CVE overview and exploitation status

EUVD-2025-12350

GHSA-hqhq-hp5x-xp3w

GO-2025-3630

cve-program · CVE-2025-43970

• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
• https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0

euvd · EUVD-2025-12350

• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
• https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0

nvd · CVE-2025-43970

• https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0
• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0

osv · GHSA-hqhq-hp5x-xp3w

• https://nvd.nist.gov/vuln/detail/CVE-2025-43970
• https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0
• https://github.com/osrg/gobgp
• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0

osv · GO-2025-3630

• https://github.com/advisories/GHSA-hqhq-hp5x-xp3w
• https://github.com/osrg/gobgp/commit/5153bafbe8dbe1a2f02a70bbf0365e98b80e47b0
• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0

• Release 2025-06-17 · Tool release · 20 Jun 2025