CVE-2025-43973 is a medium severity flaw in GoBGP, the Go implementation of BGP. Before version 3.35.0, the RTR packet code did not verify that all bytes of a message were present. Upgrade to 3.35.0 or later, and only accept RTR sessions from RPKI caches you control.
What's affected
- Product: GoBGP from the osrg project, including the Go module
github.com/osrg/gobgp/v3. - Affected: versions before 3.35.0.
- Fixed version: 3.35.0, per the record and the project's v3.34.0 to v3.35.0 comparison.
- Location:
pkg/packet/rtr/rtr.go, the code that parses RPKI to Router (RTR) protocol messages. - Severity: CVSS 6.8 (medium).
How to check if you're exposed
# the daemon, as installed by your package manager
dpkg -l | grep -i gobgp
# a Go project that imports the library
go list -m github.com/osrg/gobgp/v3
grep gobgp go.mod
Also check container images and vendored copies. If you embed GoBGP in a larger tool, look in that tool's dependency list. Then find out whether you use RTR at all: if you do not configure an RPKI server, the vulnerable parsing code is not reached through normal operation, although you should still upgrade.
To see which of your projects pull in an affected component, run the free in-browser dependency scan at gold.safeguard.sh/scan. Reachability analysis then helps you separate libraries that your code actually calls from ones that only sit in a lockfile.
What to do now
- Upgrade GoBGP to 3.35.0 or later. For Go projects, update the module with
go get github.com/osrg/gobgp/v3@v3.35.0and rebuild. - Redeploy every binary and container image built with an older version. The fix lives in the compiled program, not in the config.
- Restrict RTR sessions to RPKI validators you run or trust, and keep that traffic on a management network.
- Watch the daemon for crashes or restarts after RTR activity, and keep the previous known good configuration available.
- Record GoBGP in your inventory with the version, so the next advisory is a quick lookup.
Why it matters
The weakness is CWE-193, an off by one error. The record describes it as a missing check that the input length matches a message where all bytes are available. When a parser trusts the length it expects and reads beyond what arrived, it can fail on malformed input, and the only impact the CVSS vector scores is on availability.
Routing software deserves care even at medium severity. A BGP speaker that restarts drops sessions and withdraws routes, and a peer or cache that you rely on for origin validation is a trust relationship. The record does not mark this CVE as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities list.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
GoBGP 3.35.0. Earlier versions do not check that the full RTR message is present.
Am I exposed if I do not use RPKI?
The vulnerable code handles RTR messages, so an instance with no RTR sessions has less exposure. Upgrade anyway, because configuration changes over time.
Sources
Last reviewed: 18 October 2026.
