This vulnerability is caused by an improper access control check in the DecodeFromBytes function of GoBGP’s BGP OPEN message handler. The flaw arises when an attacker manipulates the domainNameLen field, allowing bypass of privilege restrictions and potentially granting unauthorized access to sensitive BGP functions or data. The weakness aligns with CWE-266 and CWE-284, representing an improper restriction of excessive privileges and general improper access control, respectively. The nature of the exploit is remote, requiring a high degree of technical skill and making exploitation difficult, but the impact could allow an attacker to compromise BGP sessions or obtain privileged information.

The affected product is osrg GoBGP version 4.3.0 and earlier. Any deployment of GoBGP that has not been upgraded past this release is vulnerable, regardless of environment.

The CVSS score of 6.3 reflects moderate severity, while the EPSS score is not available. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers would need to send a crafted BGP OPEN message remotely with a manipulated domainNameLen value; the high exploitation complexity and difficulty reduce the immediate threat, yet the possibly high impact warrants prompt attention.