Low severity · published Jul 12, 2025
CVE-2025-7464
osrg GoBGP rtr.go SplitRTR out-of-bounds
3.7
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
GoBGP · osrg
3.0; 3.1; 3.2; 3.3; 3.4; 3.5; +32 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-7464
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-7464
github.com
https://github.com/osrg/gobgp/commit/e748f43496d74946d14fed85c776452e47b99d64
vuldb.com
https://vuldb.com/?ctiid.316116
vuldb.com
https://vuldb.com/?id.316116
vuldb.com
https://vuldb.com/?submit.610193
More from GoBGP
9.8
CVE-2025-43973
An issue was discovered in GoBGP before 3.35.0
7.5
CVE-2026-41643
GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
7.5
CVE-2026-42285
GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
7.5
CVE-2026-41642
GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
7.5
CVE-2026-7737
osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds