CVE-2026-5123 osrg GoBGP bgp.go DecodeFromBytes off-by-one
An off-by-one error in GoBGP's DecodeFromBytes function allows remote attackers to cause a denial of service via complex manipulation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-5123?
CVE-2026-5123 is a medium-severity vulnerability in osrg GoBGP, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A weakness has been identified in osrg GoBGP up to 4.3.0. This impacts the function DecodeFromBytes of the file pkg/packet/bgp/bgp.go. Executing a manipulation of the argument data[1] can lead to off-by-one. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is said to be difficult. This patch is called 67c059413470df64bc20801c46f64058e88f800f. A patch should be applied to remediate this issue.
Which versions are affected by CVE-2026-5123?
It affects 1 product.
Products include Osrg Gobgp.
How do I fix CVE-2026-5123?
Apply the vendor's patch.
Is CVE-2026-5123 being exploited?
There is no known exploitation of CVE-2026-5123 in the wild and no public exploit code.
Other vulnerabilities in osrg GoBGP
- CVE-2025-43971 GoBGP panics due to a zero value for softwareVersionLen
- CVE-2026-41642 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
- CVE-2026-41643 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
- CVE-2026-42285 GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
- CVE-2026-37461 GoBGP has an out-of-bounds read in the ParseIP6Extended function
Sources
Also known as DEBIAN-CVE-2026-5123, GHSA-m763-9mqf-95rq, UBUNTU-CVE-2026-5123.