A flaw exists in the GoBGP BGP OPEN message decoder that occurs when the domainNameLen argument is manipulated. This flaw leads to improper access controls, which can allow an attacker to bypass protections that normally restrict who may establish BGP sessions or modify configuration data. Based on the description, it is inferred that an attacker could potentially create or alter privileged BGP configuration and routing information, thereby degrading the integrity and reliability of the routing infrastructure. The weakness is classified as an access control failure (CWE-266) and a general authorization flaw (CWE-284).

The vulnerability affects the GoBGP networking daemon released by osrg. Specifically, all releases up to and including version 4.3.0 are impacted. Users who have not applied the patch associated with commit 2b09db390a3d455808363c53e409afe6b1b86d2d, or who are running GoBGP 4.3.0 or earlier, are susceptible to the described flaw. Updating to a version published after the patch, or applying the patch directly, resolves the issue.

The CVSS score of 6.3 rates this issue as medium severity, and the EPSS score of less than 1% indicates a low probability of widespread exploitation. The flaw is not listed in CISA’s KEV catalog, suggesting no current widespread exploitation detection. The likely attack vector is remote, leveraging the BGP OPEN message that is normally exchanged between peers. Attack requirements include high complexity and a difficult exploitation process, meaning that only advanced threat actors with detailed knowledge of BGP behavior are likely to succeed. Nonetheless, because the vulnerability can affect routing integrity and confidentiality, timely mitigation is essential.