CVE-2025-7464— osrg GoBGP rtr.go SplitRTR out-of-bounds
Quick assessment
Affected
osrg GoBGP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GoBGP是osrg开源的一种开源的边界网关协议（BGP）实现。 GoBGP 3.37.0及之前版本存在安全漏洞，该漏洞源于文件pkg/packet/rtr/rtr.go中函数SplitRTR存在越界读取。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application T1210 · Exploitation of Remote Services
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-7464
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
osrg GoBGP rtr.go SplitRTR out-of-bounds
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
GoBGP 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
GoBGP是osrg开源的一种开源的边界网关协议（BGP）实现。 GoBGP 3.37.0及之前版本存在安全漏洞，该漏洞源于文件pkg/packet/rtr/rtr.go中函数SplitRTR存在越界读取。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-7464
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-7464
请登录查看更多情报信息。
Patches & Fixes for CVE-2025-7464 (1)
IV. Related Vulnerabilities
Same product: GoBGP
-
CVE-2026-49838
GoBGP confederation validation panics on empty AS_PATH attri -
CVE-2026-49837
GoBGP: BGP OPEN capability parser may read capability values -
CVE-2026-41643
GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4B -
CVE-2026-42285
GoBGP: Panic in AdjRib.Update via malformed BGP Update messa -
CVE-2026-41642
GoBGP: Remote Denial of Service (Panic) via Malformed Well-k
Same vendor: osrg
-
CVE-2026-49838
GoBGP confederation validation panics on empty AS_PATH attri -
CVE-2026-49837
GoBGP: BGP OPEN capability parser may read capability values -
CVE-2026-41643
GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4B -
CVE-2026-42285
GoBGP: Panic in AdjRib.Update via malformed BGP Update messa -
CVE-2026-41642
GoBGP: Remote Denial of Service (Panic) via Malformed Well-k
Same weakness: CWE-125
-
CVE-2026-107220
Excelize: Panic in cellInRange on a worksheet with an empty -
CVE-2026-76457
Cisco NX-OS Software Security Hardening Release: October 202 -
CVE-2026-77214
libexpat Heap Buffer Over-read in xmlparse.c via XML_ParseBu -
CVE-2026-106061
Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnai -
CVE-2026-65122
NVIDIA TensorRT越界读取漏洞致拒绝服务
V. Comments for CVE-2025-7464
No comments yet