CVE-2025-30077 onos-lib-go allows an index out-of-range panic
An attacker can cause a denial of service in ONOS SD-RAN by triggering an index out-of-range panic in the ASN.1 parser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-30077?
CVE-2025-30077 is a medium-severity denial of service vulnerability in onosproject onos-lib-go, published on 16 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits.
Weakness: CWE-129
Which versions are affected by CVE-2025-30077?
3 open source packages ship an affected version, including github.com/onosproject/onos-lib-go.
| Package | Affected | Fixed in |
|---|---|---|
github.com/onosproject/onos-lib-go Go | All versions | None |
github.com/onosproject/onos-lib-go Go | All versions to 0.10.28 | None |
github.com/onosproject/onos-lib-go Go | All versions to 0.10.28 | None |
How do I fix CVE-2025-30077?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-30077 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-30077 exists.
Sources
Also known as GHSA-jrqj-6vq2-7r63, GO-2025-3526.