GoBGP panics due to a zero value for softwareVersionLen

Description

References

• nvd.nist.gov/vuln/detail/CVE-2025-43971 · ADVISORY
• osrg/gobgp commit 08a001e · WEB
• osrg/gobgp · PACKAGE
• osrg/gobgp · WEB
• security-tracker.debian.org/tracker/CVE-2025-43971 · WEB
• GitHub Advisory GHSA-7m35-vw2c-696v · ADVISORY

Weitere Schwachstellen in github.com/osrg/gobgp

• CVE-2026-7737HOCH 7.5A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisti…
• CVE-2026-30405HOCH 7.5An issue in GoBGP gobgpd v.4.2.0 allows a remote attacker to cause a denial of service via the NEXT_HOP path attribute
• CVE-2025-43973KRITISCH 9.8An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in wh…
• CVE-2025-43972HOCH 7.5An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer …
• CVE-2025-43970MITTEL 5.3An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there…