CVE-2026-5124

Katalog CVE

CVSS 3.7 · Low EPSS 0,47%

Kerentanan Incorrect Privilege Assignment pada osrg gobgp. Skor CVSS 3.1 3.7 (Low) menurut vuldb.com.

Deskripsi (NVD)

A security vulnerability has been detected in osrg GoBGP up to 4.3.0. Affected is the function BGPHeader.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component BGP Header Handler. The manipulation leads to improper access controls. Remote exploitation of the attack is possible. The attack is considered to have high complexity. The exploitability is told to be difficult. The identifier of the patch is f0f24a2a901cbf159260698211ab15c583ced131. To fix this issue, it is recommended to deploy a patch.

Rincian

Terbit di NVD

30 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

3.7 (Low), sumber vuldb.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-266: Incorrect Privilege Assignment
CWE-284: Improper Access Control

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 38,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/osrg/gobgp/commit/f0f24a2a901cbf159260698211ab15c583ced131 patch
• https://vuldb.com/submit/780189 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/354156 advisory pihak ketiga · vdb entry
• https://github.com/osrg/gobgp/ product
• https://github.com/osrg/gobgp/pull/3340 issue tracking
• https://vuldb.com/vuln/354156/cti permissions required · vdb entry