{"id":"CVE-2023-46565","aliases":["DEBIAN-CVE-2023-46565","EUVD-2024-1131","GHSA-6rqv-5cg7-m4x3","GO-2024-3124","UBUNTU-CVE-2023-46565","USN-7661-1","openSUSE-SU-2024:14564-1","openSUSE-SU-2026:21788-1"],"status":"published","title":"Buffer Overflow vulnerability in osrg gobgp","description":"Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.0075,"percentile":0.55283,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2024-04-29T00:00:00Z","modified":"2026-10-26T18:03:07Z","fixes":[{"ecosystem":"Debian:14","package":"gobgp","fixed_in":["4.3.0-1"],"sources":["osv"]},{"ecosystem":"Go","package":"github.com/osrg/gobgp/v3","fixed_in":["3.20.0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gobgp","fixed_in":["2.12.0-1ubuntu0.1~esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gobgp","fixed_in":["2.25.0-3ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"lxd","fixed_in":["5.21.1-2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/osrg/gobgp/v3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"3.20.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.0-1","3.16.0-1","3.19.0-1","3.21.0-1","3.23.0-1","3.25.0-1","3.27.0-1","3.28.0-1","3.29.0-1","3.30.0-1","3.31.0-1","3.32.0-1","3.33.0-1","3.35.0-1","3.36.0-1","3.36.0-2","4.3.0-1","4.4.0-1","4.5.0-1","4.5.0-1~bpo13+1","4.6.0-1","4.6.0-2","4.6.0-2~bpo13+1","4.7.0-1","4.7.0-1~bpo13+1","4.8.0-1","4.8.0-1~bpo13+1","4.8.0-2~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.36.0-2","4.3.0-1","4.4.0-1","4.5.0-1","4.5.0-1~bpo13+1","4.6.0-1","4.6.0-2","4.6.0-2~bpo13+1","4.7.0-1","4.7.0-1~bpo13+1","4.8.0-1","4.8.0-1~bpo13+1","4.8.0-2~exp1"]},{"source":"osv","ecosystem":"Debian:14","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-1"}]}],"versions":["3.36.0-2"]},{"source":"osv","ecosystem":"Go","package":"github.com/osrg/gobgp/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"3.20.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/osrg/gobgp/v3","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.20.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.15-1","1.29-1","1.29-1ubuntu0.1+esm1","1.29-1ubuntu0.1+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1ubuntu0.1~esm2"}]}],"versions":["1.33-1","2.11.0-1","2.12.0-1","2.12.0-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.0-3ubuntu0.1+esm2"}]}],"versions":["2.25.0-2","2.25.0-3","2.25.0-3build1","2.25.0-3ubuntu0.1","2.25.0-3ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-1ubuntu0.1+esm1"}]}],"versions":["1.15-1","1.29-1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1ubuntu0.1~esm2"}]}],"versions":["1.33-1","2.11.0-1","2.12.0-1","2.12.0-1ubuntu0.1~esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.0-3ubuntu0.1+esm2"}]}],"versions":["2.25.0-2","2.25.0-3","2.25.0-3build1","2.25.0-3ubuntu0.1","2.25.0-3ubuntu0.1+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.23.0-1ubuntu0.3+esm2"}]}],"versions":["3.16.0-1build1","3.19.0-1","3.21.0-1","3.23.0-1","3.23.0-1ubuntu0.1","3.23.0-1ubuntu0.2","3.23.0-1ubuntu0.2+esm1","3.23.0-1ubuntu0.3","3.23.0-1ubuntu0.3+esm1"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"lxd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.6-bp160.1.1"}]}],"bundled":9}],"products":[{"vendor":"osrg","product":"gobgp"}],"references":[{"url":"https://github.com/osrg/gobgp/issues/2725","tags":["x_transferred","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46565","tags":["advisory"]},{"url":"https://github.com/osrg/gobgp/commit/419c50dfac578daa4d11256904d0dc182f1a9b22","tags":["web","fix"]},{"url":"https://github.com/advisories/GHSA-6rqv-5cg7-m4x3"},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46565","tags":["advisory"]},{"url":"https://github.com/osrg/gobgp","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2023-46565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46565","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7661-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-43970","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-43971","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-43972","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-43973","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZCQS6RMOC2Q5273B7YW7J7TI3QYWL4IT/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46565","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223794","tags":["report"]},{"url":"https://bugzilla.suse.com/1274936","tags":["report"]},{"url":"https://bugzilla.suse.com/1274937","tags":["report"]},{"url":"https://bugzilla.suse.com/1274954","tags":["report"]},{"url":"https://bugzilla.suse.com/1274961","tags":["report"]},{"url":"https://bugzilla.suse.com/1274963","tags":["report"]},{"url":"https://bugzilla.suse.com/1275084","tags":["report"]},{"url":"https://bugzilla.suse.com/1275085","tags":["report"]},{"url":"https://bugzilla.suse.com/1275090","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-62420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63293","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63295","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-63299","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-66898","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-46565","description":"Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.","status":"published","published":"2024-04-29T00:00:00Z","modified":"2024-09-06T19:02:56.837Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2024-1131","description":"Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.","status":"published","published":"2024-04-29T00:00:00Z","modified":"2024-09-06T19:02:56Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:01.652315Z"}],"ghsa":[{"id":"GHSA-6rqv-5cg7-m4x3","title":"Buffer Overflow vulnerability in osrg gobgp","description":"Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.","status":"published","published":"2024-04-29T21:30:34Z","modified":"2024-09-06T22:13:56Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:38:01.080229Z"}],"nvd":[{"id":"CVE-2023-46565","description":"Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.","status":"published","published":"2024-04-29T20:15:08.157Z","modified":"2026-06-17T06:31:08.187Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:09:11.362739Z"}],"osv":[{"id":"CVE-2023-46565","description":"Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.","status":"published","published":"2024-04-29T20:15:08.157Z","modified":"2026-09-09T18:26:45.223845178Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DEBIAN-CVE-2023-46565","description":"Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.","status":"published","published":"2024-04-29T20:15:08.157Z","modified":"2026-10-26T18:03:07.031791129Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"GHSA-6rqv-5cg7-m4x3","title":"Buffer Overflow vulnerability in osrg gobgp","description":"Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.","status":"published","published":"2024-04-29T21:30:34Z","modified":"2026-08-07T08:12:18.942465012Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"UBUNTU-CVE-2023-46565","description":"Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of service via the handlingError function in pkg/server/fsm.go.","status":"published","published":"2024-04-29T20:15:00Z","modified":"2026-06-03T07:15:13.230470877Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"GO-2024-3124","title":"Buffer Overflow vulnerability in osrg gobgp in github.com/osrg/gobgp","description":"Buffer Overflow vulnerability allows a remote attacker to cause a denial of service via an fsm error handling function.","status":"published","published":"2024-09-17T21:00:57Z","modified":"2026-08-07T08:12:30.387816532Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:14564-1","title":"lxd-5.21.1-2.1 on GA media","description":"These are all security issues fixed in the lxd-5.21.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-12-09T00:00:00Z","modified":"2026-02-04T02:51:44.844522Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"openSUSE-SU-2026:21788-1","title":"Security update for lxd","description":"This update for lxd fixes the following issues:\n\nChanges in lxd:\n\n- update to 5.21.6:\n  * bsc#1274937, CVE-2026-63293, bsc#1274936, CVE-2026-62420,\n    bsc#1274954, CVE-2026-63295, bsc#1274963, CVE-2026-63297,\n    bsc#1274961, CVE-2026-63296, bsc#1275085, CVE-2026-63299,\n    bsc#1275084, CVE-2026-63298, bsc#1275090, CVE-2026-66898\n  * https://canonical.com/lxd/docs/latest/reference/release-\n    notes/5.21/release-notes-5.21.6/\n  * https://canonical.com/lxd/docs/latest/reference/release-\n    notes/5.21/release-notes-5.21.5/\n  * https://discourse.ubuntu.com/t/lxd-5-21-4-lts-has-been-\n    released/66602\n  * https://discourse.ubuntu.com/t/lxd-5-21-3-lts-has-been-\n    released/53768\n  * https://discourse.ubuntu.com/t/lxd-5-21-2-has-been-\n    released/46443\n\n- Migrate to single LXD/Incus OVMF handling (lxd-ovmf-setup):\n  * Allow aarch64 arch_vm_support\n  * Remove OVMF symlinks\n  * Require the new lxd-ovmf-setup packages\n","status":"published","published":"2026-09-02T12:35:45Z","modified":"2026-09-09T18:23:15.579056028Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"USN-7661-1","title":"gobgp vulnerabilities","description":"It was discovered that GoBGP did not properly manage memory under\ncertain circumstances, which could lead to a buffer overflow. An\nattacker could possibly use this issue to cause a denial of service. This\nissue was only addressed in Ubuntu 22.04 LTS and Ubuntu 20.04 LTS.\n(CVE-2023-46565)\n\nIt was discovered that GoBGP did not properly verify the length of\ncertain inputs. An attacker could possibly use this issue to cause a\npanic resulting in a denial of service.\n(CVE-2025-43970, CVE-2025-43971, CVE-2025-43972, CVE-2025-43973)","status":"published","published":"2025-07-22T04:58:40Z","modified":"2026-04-27T18:11:40.269833Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}