Low severity3.7NVD Advisory· Published Mar 30, 2026· Updated Apr 8, 2026
CVE-2026-5122
CVE-2026-5122
Description
A security flaw has been discovered in osrg GoBGP up to 4.3.0. This affects the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP OPEN Message Handler. Performing a manipulation of the argument domainNameLen results in improper access controls. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The patch is named 2b09db390a3d455808363c53e409afe6b1b86d2d. It is suggested to install a patch to address this issue.
Affected products
1Patches
12b09db390a3dhttps://github.com/osrg/gobgpvia nvd-ref
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
5- github.com/osrg/gobgp/commit/2b09db390a3d455808363c53e409afe6b1b86d2dnvdPatch
- vuldb.com/submit/780124nvdThird Party AdvisoryVDB Entry
- vuldb.com/vuln/354154nvdThird Party AdvisoryVDB Entry
- github.com/osrg/gobgp/pull/3343nvdIssue Tracking
- vuldb.com/vuln/354154/ctinvdPermissions RequiredVDB Entry
News mentions
0No linked articles in our index yet.