CVE-2026-5124

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5124", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-03-30T07:50:38.468Z", "datePublished": "2026-03-30T16:15:12.565Z", "dateUpdated": "2026-03-30T18:39:46.466Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-30T16:15:12.565Z"}, "title": "osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-284", "lang": "en", "description": "Improper Access Controls"}]}, {"descriptions": [{"type": "CWE", "cweId": "CWE-266", "lang": "en", "description": "Incorrect Privilege Assignment"}]}], "affected": [{"vendor": "osrg", "product": "GoBGP", "versions": [{"version": "4.0", "status": "affected"}, {"version": "4.1", "status": "affected"}, {"version": "4.2", "status": "affected"}, {"version": "4.3.0", "status": "affected"}], "modules": ["BGP Header Handler"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in osrg GoBGP up to 4.3.0. Affected is the function BGPHeader.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP Header Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is told to be difficult. The identifier of the patch is f0f24a2a901cbf159260698211ab15c583ced131. To fix this issue, it is recommended to deploy a patch."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2026-03-30T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-03-30T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-03-30T09:55:45.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Sunxj (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/vuln/354156", "name": "VDB-354156 | osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354156/cti", "name": "VDB-354156 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780189", "name": "Submit #780189 | osrg GoBGP 4.3.0 Improper Input Validation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/osrg/gobgp/pull/3340", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/osrg/gobgp/commit/f0f24a2a901cbf159260698211ab15c583ced131", "tags": ["patch"]}, {"url": "https://github.com/osrg/gobgp/", "tags": ["product"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T18:39:39.298762Z", "id": "CVE-2026-5124", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T18:39:46.466Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5124", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T18:39:39.298762Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T18:39:43.122Z"}}], "cna": {"tags": ["x_open-source"], "title": "osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control", "credits": [{"lang": "en", "type": "reporter", "value": "Sunxj (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.7, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.6, "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N/E:ND/RL:OF/RC:C"}}], "affected": [{"vendor": "osrg", "modules": ["BGP Header Handler"], "product": "GoBGP", "versions": [{"status": "affected", "version": "4.0"}, {"status": "affected", "version": "4.1"}, {"status": "affected", "version": "4.2"}, {"status": "affected", "version": "4.3.0"}]}], "timeline": [{"lang": "en", "time": "2026-03-30T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-03-30T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-03-30T09:55:45.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/354156", "name": "VDB-354156 | osrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access control", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/354156/cti", "name": "VDB-354156 | CTI Indicators (IOB, IOC, TTP, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/780189", "name": "Submit #780189 | osrg GoBGP 4.3.0 Improper Input Validation", "tags": ["third-party-advisory"]}, {"url": "https://github.com/osrg/gobgp/pull/3340", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/osrg/gobgp/commit/f0f24a2a901cbf159260698211ab15c583ced131", "tags": ["patch"]}, {"url": "https://github.com/osrg/gobgp/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in osrg GoBGP up to 4.3.0. Affected is the function BGPHeader.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP Header Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is told to be difficult. The identifier of the patch is f0f24a2a901cbf159260698211ab15c583ced131. To fix this issue, it is recommended to deploy a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "Improper Access Controls"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-03-30T16:15:12.565Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5124", "state": "PUBLISHED", "dateUpdated": "2026-03-30T18:39:46.466Z", "dateReserved": "2026-03-30T07:50:38.468Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-03-30T16:15:12.565Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["BGP Header Handler"], "product": "GoBGP", "vendor": "osrg", "versions": [{"status": "affected", "version": "4.0"}, {"status": "affected", "version": "4.1"}, {"status": "affected", "version": "4.2"}, {"status": "affected", "version": "4.3.0"}]}], "source": "cna@vuldb.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:*", "matchCriteriaId": "05DBB6FD-F3CD-4BF0-A573-D1E87307A50F", "versionEndExcluding": "4.4.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in osrg GoBGP up to 4.3.0. Affected is the function BGPHeader.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP Header Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is told to be difficult. The identifier of the patch is f0f24a2a901cbf159260698211ab15c583ced131. To fix this issue, it is recommended to deploy a patch."}, {"lang": "es", "value": "Una vulnerabilidad de seguridad ha sido detectada en osrg GoBGP hasta la versi\u00f3n 4.3.0. Afectada es la funci\u00f3n BGPHeader.DecodeFromBytes del archivo pkg/packet/bgp/bgp.go del componente Gestor de Cabecera BGP. La manipulaci\u00f3n conduce a controles de acceso inadecuados. La explotaci\u00f3n remota del ataque es posible. El ataque se considera que tiene alta complejidad. La explotabilidad se dice que es dif\u00edcil. El identificador del parche es f0f24a2a901cbf159260698211ab15c583ced131. Para solucionar este problema, se recomienda desplegar un parche."}], "id": "CVE-2026-5124", "lastModified": "2026-06-17T10:58:28.630", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.6, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-5124", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-30T18:39:39.298762Z", "version": "2.0.3"}}]}, "published": "2026-03-30T17:16:16.087", "references": [{"source": "cna@vuldb.com", "tags": ["Product"], "url": "https://github.com/osrg/gobgp/"}, {"source": "cna@vuldb.com", "tags": ["Patch"], "url": "https://github.com/osrg/gobgp/commit/f0f24a2a901cbf159260698211ab15c583ced131"}, {"source": "cna@vuldb.com", "tags": ["Issue Tracking"], "url": "https://github.com/osrg/gobgp/pull/3340"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/submit/780189"}, {"source": "cna@vuldb.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://vuldb.com/vuln/354156"}, {"source": "cna@vuldb.com", "tags": ["Permissions Required", "VDB Entry"], "url": "https://vuldb.com/vuln/354156/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-266"}, {"lang": "en", "value": "CWE-284"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.0"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.1"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.2"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.3.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "GoBGP", "source": "cna", "vendor": "osrg"}, "product": "gobgp", "vendor": "osrg"}], "analysis": {"en": {"generated_at": "2026-04-06T19:48:58.980479+00:00", "value": {"mitigation_remediation": ["Apply the hot\u2011fix commit f0f24a2a901cbf159260698211ab15c583ced131 to the GoBGP codebase.", "Upgrade your GoBGP deployment to a version newer than 4.3.0, which includes the patch.", "Review and tighten BGP peering configurations to restrict the acceptance of routes from untrusted peers."], "summary": {"action": "Patch", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "The flaw affects the GoBGP routing software produced by osrg, specifically any installation running version\u202f4.3.0 or earlier. The affected component is the BGP Header Handler, which is part of the GoBGP core packet library. No further version granularity is listed in the CNA data beyond the 4.3.0 cutoff.", "description_and_impact": "The vulnerability resides in the BGPHeader.DecodeFromBytes function within GoBGP\u2019s packet handling module. The function fails to enforce proper access controls on BGP header data received from remote peers, allowing a malicious actor to manipulate the parsing logic. Because the BGP header dictates how routing updates are interpreted, this flaw can lead to unauthorized manipulation of routing information or potential disclosure of state. The description indicates remote exploitation is possible, though the attack requires high complexity and is considered difficult to execute.", "risk_and_exploitability": "The CVSS score of\u202f6.3 places the vulnerability in the moderate range, while the EPSS score of less than\u202f1\u202f% indicates a low probability of observed exploitation. The flaw is not currently listed in CISA\u2019s KEV catalog, so it is not known to have been widely exploited in the wild. Attackers would need to establish a BGP session with a vulnerable GoBGP instance and craft a malicious header, making the exploitation path complex and demanding expertise in BGP protocol internals. In the absence of an active exploitation tool, the overall risk to deployed systems remains moderate but actionable."}}}}, "created": "2026-03-30T20:55:30.984796+00:00", "updated": "2026-04-07T08:08:33.650646+00:00", "vendors": ["osrg", "osrg$PRODUCT$gobgp"]}