CVE-2023-46565
Buffer Overflow vulnerability in osrg gobgp
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
- Record
CVE-2023-46565- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2024-1131
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
- Record
EUVD-2024-1131- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6rqv-5cg7-m4x3
Buffer Overflow vulnerability in osrg gobgp
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
- Record
GHSA-6rqv-5cg7-m4x3- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
- Record
CVE-2023-46565- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSV
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
- Record
CVE-2023-46565- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-46565
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
- Record
DEBIAN-CVE-2023-46565- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-6rqv-5cg7-m4x3
Buffer Overflow vulnerability in osrg gobgp
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
- Record
GHSA-6rqv-5cg7-m4x3- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-46565
Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.
- Record
UBUNTU-CVE-2023-46565- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGO-2024-3124 No score
Buffer Overflow vulnerability in osrg gobgp in github.com/osrg/gobgp
Buffer Overflow vulnerability allows a remote attacker to cause a denial of service via an fsm error handling function.
- Record
GO-2024-3124- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14564-1 No score
lxd-5.21.1-2.1 on GA media
These are all security issues fixed in the lxd-5.21.1-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14564-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21788-1 No score
Security update for lxd
This update for lxd fixes the following issues:
Changes in lxd:
-
update to 5.21.6:
- bsc#1274937, CVE-2026-63293, bsc#1274936, CVE-2026-62420, bsc#1274954, CVE-2026-63295, bsc#1274963, CVE-2026-63297, bsc#1274961, CVE-2026-63296, bsc#1275085, CVE-2026-63299, bsc#1275084, CVE-2026-63298, bsc#1275090, CVE-2026-66898
- https://canonical.com/lxd/docs/latest/reference/release- notes/5.21/release-notes-5.21.6/
- https://canonical.com/lxd/docs/latest/reference/release- notes/5.21/release-notes-5.21.5/
- https://discourse.ubuntu.com/t/lxd-5-21-4-lts-has-been- released/66602
- https://discourse.ubuntu.com/t/lxd-5-21-3-lts-has-been- released/53768
- https://discourse.ubuntu.com/t/lxd-5-21-2-has-been- released/46443
-
Migrate to single LXD/Incus OVMF handling (lxd-ovmf-setup):
- Allow aarch64 arch_vm_support
- Remove OVMF symlinks
- Require the new lxd-ovmf-setup packages
- Record
openSUSE-SU-2026:21788-1- Updated
- 2026-11-02
OSVUSN-7661-1 No score
gobgp vulnerabilities
It was discovered that GoBGP did not properly manage memory under certain circumstances, which could lead to a buffer overflow. An attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 22.04 LTS and Ubuntu 20.04 LTS. (CVE-2023-46565)
It was discovered that GoBGP did not properly verify the length of certain inputs. An attacker could possibly use this issue to cause a panic resulting in a denial of service. (CVE-2025-43970, CVE-2025-43971, CVE-2025-43972, CVE-2025-43973)
- Record
USN-7661-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/osrg/gobgp/v3Go |
through 3.20.0 | None known |
gobgpDebian:12 |
All versions, plus listed versions 3.10.0-13.16.0-13.19.0-13.21.0-13.23.0-1 Show 23 moreShow less3.25.0-13.27.0-13.28.0-13.29.0-13.30.0-13.31.0-13.32.0-13.33.0-13.35.0-13.36.0-13.36.0-24.3.0-14.4.0-14.5.0-14.5.0-1~bpo13+14.6.0-14.6.0-24.6.0-2~bpo13+14.7.0-14.7.0-1~bpo13+14.8.0-14.8.0-1~bpo13+14.8.0-2~exp1 |
None known |
gobgpDebian:13 |
All versions, plus listed versions 3.36.0-24.3.0-14.4.0-14.5.0-14.5.0-1~bpo13+1 Show 8 moreShow less4.6.0-14.6.0-24.6.0-2~bpo13+14.7.0-14.7.0-1~bpo13+14.8.0-14.8.0-1~bpo13+14.8.0-2~exp1 |
None known |
gobgpDebian:14 |
before 4.3.0-1, plus listed versions 3.36.0-2 |
4.3.0-1 |
github.com/osrg/gobgp/v3Go |
before 3.20.0 | 3.20.0 |
gobgpUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.15-11.29-11.29-1ubuntu0.1+esm11.29-1ubuntu0.1+esm2 |
None known |
gobgpUbuntu:Pro:20.04:LTS |
before 2.12.0-1ubuntu0.1~esm2, plus listed versions 1.33-12.11.0-12.12.0-12.12.0-1ubuntu0.1~esm1 |
2.12.0-1ubuntu0.1~esm2 |
gobgpUbuntu:Pro:22.04:LTS |
before 2.25.0-3ubuntu0.1+esm2, plus listed versions 2.25.0-22.25.0-32.25.0-3build12.25.0-3ubuntu0.12.25.0-3ubuntu0.1+esm1 |
2.25.0-3ubuntu0.1+esm2 |
gobgpUbuntu:Pro:18.04:LTS From an advisory covering 5 CVEs |
before 1.29-1ubuntu0.1+esm1, plus listed versions 1.15-11.29-1 |
1.29-1ubuntu0.1+esm1 |
gobgpUbuntu:Pro:20.04:LTS From an advisory covering 5 CVEs |
before 2.12.0-1ubuntu0.1~esm2, plus listed versions 1.33-12.11.0-12.12.0-12.12.0-1ubuntu0.1~esm1 |
2.12.0-1ubuntu0.1~esm2 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gobgpUbuntu:Pro:22.04:LTS From an advisory covering 5 CVEs |
before 2.25.0-3ubuntu0.1+esm2, plus listed versions 2.25.0-22.25.0-32.25.0-3build12.25.0-3ubuntu0.12.25.0-3ubuntu0.1+esm1 |
2.25.0-3ubuntu0.1+esm2 |
gobgpUbuntu:Pro:24.04:LTS From an advisory covering 5 CVEs |
before 3.23.0-1ubuntu0.3+esm2, plus listed versions 3.16.0-1build13.19.0-13.21.0-13.23.0-13.23.0-1ubuntu0.1 Show 4 moreShow less3.23.0-1ubuntu0.23.23.0-1ubuntu0.2+esm13.23.0-1ubuntu0.33.23.0-1ubuntu0.3+esm1 |
3.23.0-1ubuntu0.3+esm2 |
lxdopenSUSE:Tumbleweed |
before 5.21.1-2.1 | 5.21.1-2.1 |
lxdopenSUSE:Leap 16.0 From an advisory covering 9 CVEs |
before 5.21.6-bp160.1.1 | 5.21.6-bp160.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-46565 is a high vulnerability (CVSS 7.5) in Osrg Gobgp, published April 29, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in gobgp 4.3.0-1.
References
github.com/osrg/gobgp/issues/2725
nvd.nist.gov/vuln/detail/CVE-2023-46565
security-tracker.debian.org/tracker/CVE-2023-46565
Show 26 moreShow less
ubuntu.com/security/CVE-2023-46565
cve.org/CVERecord?id=CVE-2023-46565
lists.opensuse.org/archives/list/[email protected]/thread/ZCQS6RMOC2Q5273B7YW7J7TI3QYWL4IT
suse.com/security/cve/CVE-2023-46565
bugzilla.suse.com/1223794