CVE-2025-7464: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-7464 is an out-of-bounds read vulnerability in osrg GoBGP, a BGP routing daemon implemented in Go. The flaw exists in the SplitRTR function within pkg/packet/rtr/rtr.go and affects all GoBGP versions up to and including 3.37.0. It was published on July 12, 2025, with a patch committed to the project's GitHub repository. The vulnerability carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (VulDB, Red Hat CVE).

The root cause is improper bounds checking in the SplitRTR function (CWE-125: Out-of-Bounds Read; CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer). Two specific defects were identified: first, the comparison uint32(len(data)) < totalLen could behave incorrectly due to type mismatch, and second, ParseRTR only checked that len(data) >= 1 rather than verifying the full minimum RTR message length (RTR_MIN_LEN), allowing under-sized buffers to be processed. The fix corrects both comparisons — changing the length check to len(data) < int(totalLen) and the parse guard to len(data) < RTR_MIN_LEN — as seen in commit e748f43 (GitHub Commit). Exploitation requires a network-reachable GoBGP instance and is rated high complexity, meaning specific conditions must be met to trigger the flaw (VulDB).

Successful exploitation of this vulnerability results in a limited availability impact — specifically, an out-of-bounds read that could cause the GoBGP process to crash or behave unexpectedly, disrupting BGP routing operations. There is no assessed impact to confidentiality or integrity. In network environments where GoBGP is used as a routing daemon, a crash could cause route withdrawal and network disruption, though the high attack complexity limits the practical risk (VulDB, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-7464. The EPSS score is approximately 0.039%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Attack complexity is rated High, meaning exploitation is considered difficult and requires specific conditions to be met (VulDB).

The fix is available as commit e748f43496d74946d14fed85c776452e47b99d64 in the osrg/gobgp GitHub repository. Users should update GoBGP to a version that includes this patch (any release after 3.37.0 incorporating the fix). No configuration-based workaround has been published; applying the patch is the recommended remediation. Organizations using GoBGP in production routing environments should prioritize updating given the potential for service disruption (GitHub Commit, VulDB).