CVE-2026-5123: 
NixOS vulnerability analysis and mitigation

CVE-2026-5123 is an off-by-one error (CWE-193) in osrg GoBGP, an open-source BGP implementation written in Go. The vulnerability affects the CapSoftwareVersion.DecodeFromBytes function in pkg/packet/bgp/bgp.go across all GoBGP versions up to and including 4.3.0. It was published on March 30, 2026, with a fix merged on March 12, 2026 via pull request #3342. The vulnerability carries a CVSS v3.1 base score of 3.7 (Low) and a CVSS v4.0 base score of 6.3 (Medium) (Github Advisory, Feedly).

The root cause is an off-by-one error (CWE-193) in the CapSoftwareVersion.DecodeFromBytes function within pkg/packet/bgp/bgp.go. The flawed code used data[1:c.SoftwareVersionLen] to extract the software version string, which incorrectly truncates the last byte because the version string begins at index 1 (not 0); the correct slice is data[1:1+SoftwareVersionLen] (GoBGP PR #3342, GoBGP Commit). An attacker can trigger this condition remotely by sending a crafted BGP OPEN message containing a malformed Software Version capability, though exploitation requires high attack complexity with no privileges or user interaction needed (Github Advisory).

Successful exploitation of this vulnerability can cause a denial of service condition affecting the availability of the GoBGP service. The impact is limited to low availability disruption — there is no effect on confidentiality or integrity, and no lateral movement or data exposure risk has been identified. Because GoBGP is used as a BGP routing daemon, disruption of the service could affect network routing stability in environments where it is deployed (Github Advisory, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 0.047–0.105%, placing it in the lower percentiles for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. High attack complexity significantly limits practical exploitation, and no threat actor attribution has been reported (Feedly).

The fix is available in commit 67c059413470df64bc20801c46f64058e88f800f, merged into the GoBGP master branch on March 12, 2026, and included in version 4.4.0 and later (GoBGP Commit, GoBGP PR #3342). Operators running GoBGP versions 4.0, 4.1, 4.2, or 4.3.0 should upgrade to version 4.4.0 or later. Given the high attack complexity and limited availability impact, the immediate risk is lower than typical critical vulnerabilities, but patching remains the recommended remediation (Github Advisory).