CVE-2025-7464

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-7464", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-07-11T11:50:08.558Z", "datePublished": "2025-07-12T06:32:06.030Z", "dateUpdated": "2025-07-14T20:12:39.220Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-07-12T06:32:06.030Z"}, "title": "osrg GoBGP rtr.go SplitRTR out-of-bounds", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-125", "lang": "en", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "osrg", "product": "GoBGP", "versions": [{"version": "3.0", "status": "affected"}, {"version": "3.1", "status": "affected"}, {"version": "3.2", "status": "affected"}, {"version": "3.3", "status": "affected"}, {"version": "3.4", "status": "affected"}, {"version": "3.5", "status": "affected"}, {"version": "3.6", "status": "affected"}, {"version": "3.7", "status": "affected"}, {"version": "3.8", "status": "affected"}, {"version": "3.9", "status": "affected"}, {"version": "3.10", "status": "affected"}, {"version": "3.11", "status": "affected"}, {"version": "3.12", "status": "affected"}, {"version": "3.13", "status": "affected"}, {"version": "3.14", "status": "affected"}, {"version": "3.15", "status": "affected"}, {"version": "3.16", "status": "affected"}, {"version": "3.17", "status": "affected"}, {"version": "3.18", "status": "affected"}, {"version": "3.19", "status": "affected"}, {"version": "3.20", "status": "affected"}, {"version": "3.21", "status": "affected"}, {"version": "3.22", "status": "affected"}, {"version": "3.23", "status": "affected"}, {"version": "3.24", "status": "affected"}, {"version": "3.25", "status": "affected"}, {"version": "3.26", "status": "affected"}, {"version": "3.27", "status": "affected"}, {"version": "3.28", "status": "affected"}, {"version": "3.29", "status": "affected"}, {"version": "3.30", "status": "affected"}, {"version": "3.31", "status": "affected"}, {"version": "3.32", "status": "affected"}, {"version": "3.33", "status": "affected"}, {"version": "3.34", "status": "affected"}, {"version": "3.35", "status": "affected"}, {"version": "3.36", "status": "affected"}, {"version": "3.37.0", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in osrg GoBGP bis 3.37.0 entdeckt. Hiervon betroffen ist die Funktion SplitRTR der Datei pkg/packet/rtr/rtr.go. Durch das Beeinflussen mit unbekannten Daten kann eine out-of-bounds read-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie gilt als schwierig auszunutzen. Der Patch wird als e748f43496d74946d14fed85c776452e47b99d64 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2025-07-11T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-07-11T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-07-11T13:55:25.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "CyberGym (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.316116", "name": "VDB-316116 | osrg GoBGP rtr.go SplitRTR out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.316116", "name": "VDB-316116 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.610193", "name": "Submit #610193 | NTT Open Source GoBGP defe9ac1b1f1c854d1941a5b70dee3aaed6fb960 Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/osrg/gobgp/commit/e748f43496d74946d14fed85c776452e47b99d64", "tags": ["patch"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-14T19:12:46.250501Z", "id": "CVE-2025-7464", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-14T20:12:39.220Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7464", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-14T19:12:46.250501Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-14T19:12:51.154Z"}}], "cna": {"title": "osrg GoBGP rtr.go SplitRTR out-of-bounds", "credits": [{"lang": "en", "type": "reporter", "value": "CyberGym (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"vendor": "osrg", "product": "GoBGP", "versions": [{"status": "affected", "version": "3.0"}, {"status": "affected", "version": "3.1"}, {"status": "affected", "version": "3.2"}, {"status": "affected", "version": "3.3"}, {"status": "affected", "version": "3.4"}, {"status": "affected", "version": "3.5"}, {"status": "affected", "version": "3.6"}, {"status": "affected", "version": "3.7"}, {"status": "affected", "version": "3.8"}, {"status": "affected", "version": "3.9"}, {"status": "affected", "version": "3.10"}, {"status": "affected", "version": "3.11"}, {"status": "affected", "version": "3.12"}, {"status": "affected", "version": "3.13"}, {"status": "affected", "version": "3.14"}, {"status": "affected", "version": "3.15"}, {"status": "affected", "version": "3.16"}, {"status": "affected", "version": "3.17"}, {"status": "affected", "version": "3.18"}, {"status": "affected", "version": "3.19"}, {"status": "affected", "version": "3.20"}, {"status": "affected", "version": "3.21"}, {"status": "affected", "version": "3.22"}, {"status": "affected", "version": "3.23"}, {"status": "affected", "version": "3.24"}, {"status": "affected", "version": "3.25"}, {"status": "affected", "version": "3.26"}, {"status": "affected", "version": "3.27"}, {"status": "affected", "version": "3.28"}, {"status": "affected", "version": "3.29"}, {"status": "affected", "version": "3.30"}, {"status": "affected", "version": "3.31"}, {"status": "affected", "version": "3.32"}, {"status": "affected", "version": "3.33"}, {"status": "affected", "version": "3.34"}, {"status": "affected", "version": "3.35"}, {"status": "affected", "version": "3.36"}, {"status": "affected", "version": "3.37.0"}]}], "timeline": [{"lang": "en", "time": "2025-07-11T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-07-11T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-07-11T13:55:25.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.316116", "name": "VDB-316116 | osrg GoBGP rtr.go SplitRTR out-of-bounds", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.316116", "name": "VDB-316116 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.610193", "name": "Submit #610193 | NTT Open Source GoBGP defe9ac1b1f1c854d1941a5b70dee3aaed6fb960 Out-of-Bounds Read", "tags": ["third-party-advisory"]}, {"url": "https://github.com/osrg/gobgp/commit/e748f43496d74946d14fed85c776452e47b99d64", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue."}, {"lang": "de", "value": "Es wurde eine problematische Schwachstelle in osrg GoBGP bis 3.37.0 entdeckt. Hiervon betroffen ist die Funktion SplitRTR der Datei pkg/packet/rtr/rtr.go. Durch das Beeinflussen mit unbekannten Daten kann eine out-of-bounds read-Schwachstelle ausgenutzt werden. Der Angriff kann \u00fcber das Netzwerk angegangen werden. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie gilt als schwierig auszunutzen. Der Patch wird als e748f43496d74946d14fed85c776452e47b99d64 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-Bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2025-07-12T06:32:06.030Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7464", "state": "PUBLISHED", "dateUpdated": "2025-07-14T20:12:39.220Z", "dateReserved": "2025-07-11T11:50:08.558Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-07-12T06:32:06.030Z", "assignerShortName": "VulDB"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "GoBGP", "vendor": "osrg", "versions": [{"status": "affected", "version": "3.0"}, {"status": "affected", "version": "3.1"}, {"status": "affected", "version": "3.2"}, {"status": "affected", "version": "3.3"}, {"status": "affected", "version": "3.4"}, {"status": "affected", "version": "3.5"}, {"status": "affected", "version": "3.6"}, {"status": "affected", "version": "3.7"}, {"status": "affected", "version": "3.8"}, {"status": "affected", "version": "3.9"}, {"status": "affected", "version": "3.10"}, {"status": "affected", "version": "3.11"}, {"status": "affected", "version": "3.12"}, {"status": "affected", "version": "3.13"}, {"status": "affected", "version": "3.14"}, {"status": "affected", "version": "3.15"}, {"status": "affected", "version": "3.16"}, {"status": "affected", "version": "3.17"}, {"status": "affected", "version": "3.18"}, {"status": "affected", "version": "3.19"}, {"status": "affected", "version": "3.20"}, {"status": "affected", "version": "3.21"}, {"status": "affected", "version": "3.22"}, {"status": "affected", "version": "3.23"}, {"status": "affected", "version": "3.24"}, {"status": "affected", "version": "3.25"}, {"status": "affected", "version": "3.26"}, {"status": "affected", "version": "3.27"}, {"status": "affected", "version": "3.28"}, {"status": "affected", "version": "3.29"}, {"status": "affected", "version": "3.30"}, {"status": "affected", "version": "3.31"}, {"status": "affected", "version": "3.32"}, {"status": "affected", "version": "3.33"}, {"status": "affected", "version": "3.34"}, {"status": "affected", "version": "3.35"}, {"status": "affected", "version": "3.36"}, {"status": "affected", "version": "3.37.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue."}, {"lang": "es", "value": "Se ha detectado una vulnerabilidad clasificada como problem\u00e1tica en osrg GoBGP hasta la versi\u00f3n 3.37.0. La funci\u00f3n SplitRTR del archivo pkg/packet/rtr/rtr.go se ve afectada. La manipulaci\u00f3n provoca lecturas fuera de los l\u00edmites. El ataque puede ejecutarse en remoto. Es un ataque de complejidad bastante alta y parece dif\u00edcil de explotar. El parche se llama e748f43496d74946d14fed85c776452e47b99d64. Se recomienda aplicar un parche para solucionar este problema."}], "id": "CVE-2025-7464", "lastModified": "2026-06-17T10:05:00.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 2.6, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7464", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-14T19:12:46.250501Z", "version": "2.0.3"}}]}, "published": "2025-07-12T07:15:22.950", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/osrg/gobgp/commit/e748f43496d74946d14fed85c776452e47b99d64"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.316116"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.316116"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.610193"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-125"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"created": "2025-07-12T23:05:29.975856+00:00", "updated": "2025-07-12T23:05:29.975934+00:00", "vendors": ["osrg", "osrg$PRODUCT$gobgp"]}