An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context.

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2025-43972 · CVE overview and exploitation status

EUVD-2025-12348

GHSA-mfvv-mgf6-q25r

GO-2025-3632

cve-program · CVE-2025-43972

• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
• https://github.com/osrg/gobgp/commit/ca7383f450f7b296c5389feceef2467de5ab6e5a

euvd · EUVD-2025-12348

• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0
• https://github.com/osrg/gobgp/commit/ca7383f450f7b296c5389feceef2467de5ab6e5a

nvd · CVE-2025-43972

• https://github.com/osrg/gobgp/commit/ca7383f450f7b296c5389feceef2467de5ab6e5a
• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0

osv · GHSA-mfvv-mgf6-q25r

• https://nvd.nist.gov/vuln/detail/CVE-2025-43972
• https://github.com/osrg/gobgp/commit/ca7383f450f7b296c5389feceef2467de5ab6e5a
• https://github.com/osrg/gobgp
• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0

osv · GO-2025-3632

• https://github.com/advisories/GHSA-mfvv-mgf6-q25r
• https://github.com/osrg/gobgp/commit/ca7383f450f7b296c5389feceef2467de5ab6e5a
• https://github.com/osrg/gobgp/compare/v3.34.0...v3.35.0

• Release 2025-06-17 · Tool release · 20 Jun 2025