CVE-2025-43971: Osrg GoBGP DOS Vulnerability

CVE-2025-43971 Overview

An input validation vulnerability has been discovered in GoBGP, an open-source BGP (Border Gateway Protocol) implementation written in Go. The vulnerability exists in pkg/packet/bgp/bgp.go where a zero value for the softwareVersionLen field triggers a panic condition, leading to a denial of service. Attackers can exploit this vulnerability remotely over the network without requiring authentication or user interaction.

Critical Impact

Remote attackers can crash GoBGP instances by sending specially crafted BGP OPEN messages with a zero-length software version capability field, causing service disruption to BGP routing infrastructure.

Affected Products

• osrg gobgp versions prior to 3.35.0
• GoBGP implementations using the pkg/packet/bgp/bgp.go module
• Network infrastructure relying on vulnerable GoBGP deployments

Discovery Timeline

• 2025-04-21 - CVE-2025-43971 published to NVD
• 2025-05-08 - Last updated in NVD database

Technical Details for CVE-2025-43971

Vulnerability Analysis

This vulnerability is classified as CWE-193 (Off-by-one Error) and manifests in the Software Version Capability parser within the BGP packet handling code. The vulnerable code fails to validate that the softwareVersionLen value is non-zero before processing the software version capability data in BGP OPEN messages.

When a malformed BGP OPEN message containing a zero value for softwareVersionLen is received, the parser does not reject this invalid input. This leads to improper memory access patterns that trigger a Go panic, immediately terminating the GoBGP process. Since BGP is a critical routing protocol used in network backbone infrastructure, this denial of service can have cascading effects on network routing stability.

The vulnerability is exploitable from the network without authentication, making it particularly dangerous for internet-facing BGP implementations.

Root Cause

The root cause is an incomplete boundary check in the CapabilitySoftwareVersion parser. The original validation logic checked whether softwareVersionLen exceeded 64 bytes and whether there was sufficient data in the buffer, but failed to validate that the length was greater than zero. This off-by-one error in the boundary condition allows a zero-length value to pass validation, subsequently causing a panic when the code attempts to process zero bytes of version data.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker can craft a malicious BGP OPEN message containing a Software Version capability with softwareVersionLen set to zero. When a vulnerable GoBGP instance processes this message during the BGP session establishment phase, it triggers the panic condition and crashes the BGP daemon.

	return NewMessageError(BGP_ERROR_OPEN_MESSAGE_ERROR, BGP_ERROR_SUB_UNSUPPORTED_CAPABILITY, nil, "Not all CapabilitySoftwareVersion bytes allowed")
	}
	softwareVersionLen := uint8(data[0])
-	if len(data[1:]) < int(softwareVersionLen) || softwareVersionLen > 64 {
+	if len(data[1:]) < int(softwareVersionLen) || softwareVersionLen > 64 || softwareVersionLen == 0 {
		return NewMessageError(BGP_ERROR_OPEN_MESSAGE_ERROR, BGP_ERROR_SUB_UNSUPPORTED_CAPABILITY, nil, "invalid length of software version capablity")
	}
	c.SoftwareVersionLen = softwareVersionLen

Source: GitHub Commit Reference

Detection Methods for CVE-2025-43971

Indicators of Compromise

• Unexpected GoBGP process crashes or restarts with panic-related error messages
• BGP session flapping or repeated connection resets from specific peers
• Log entries indicating malformed BGP OPEN messages or capability parsing errors
• Network monitoring alerts showing anomalous BGP traffic patterns

Detection Strategies

• Monitor GoBGP process stability and implement alerting on unexpected terminations
• Analyze BGP packet captures for OPEN messages with zero-length Software Version capability fields
• Deploy network intrusion detection rules to identify malformed BGP capability parameters
• Review system logs for Go panic stack traces originating from pkg/packet/bgp/bgp.go

Monitoring Recommendations

• Implement BGP session state monitoring to detect rapid session cycling
• Configure process supervision to automatically restart GoBGP instances and alert on crashes
• Deploy packet inspection at network boundaries to detect malicious BGP messages
• Establish baseline metrics for BGP session stability to identify anomalous behavior

How to Mitigate CVE-2025-43971

Immediate Actions Required

• Upgrade GoBGP to version 3.35.0 or later immediately
• Review BGP peering configurations and restrict connections to trusted peers where possible
• Implement network-level filtering to limit BGP connections to authorized sources
• Enable process monitoring and automatic restart capabilities for GoBGP services

Patch Information

The vulnerability has been addressed in GoBGP version 3.35.0. The fix adds a validation check to ensure softwareVersionLen is non-zero before processing. The security patch can be reviewed at the GitHub Commit Reference. A full comparison of changes between versions is available at the GitHub Version Comparison.

Workarounds

• Implement access control lists (ACLs) to restrict BGP connections to known and trusted peers only
• Deploy a BGP-aware firewall or intrusion prevention system to filter malformed BGP messages
• Use TCP MD5 authentication for BGP sessions to add an additional authentication layer
• Consider network segmentation to isolate BGP infrastructure from untrusted network segments

# Example: Restrict BGP connections to trusted peer IPs using iptables
iptables -A INPUT -p tcp --dport 179 -s <trusted_peer_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 179 -j DROP