CVE-2026-7735

High

Published: 04/05/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

A vulnerability was found in osrg GoBGP up to version 4.3.0, affecting the function PathAttributeAigp.DecodeFromBytes in the file pkg/packet/bgp/bgp.go. Manipulating this function can lead to buffer overflow, allowing for remote attacks.

Risk Assessment

An attacker can remotely exploit this vulnerability, potentially leading to serious security implications for the system.

Recommendation

It is recommended to upgrade to version 4.4.0, which addresses this issue. The patch named 51ad1ada06cb41ce47b7066799981816f50b7ced should also be applied.

Other vulnerabilities in osrg GoBGP

CVE-2026-7736High
A vulnerability was identified in osrg GoBGP up to version 4.3.0, concerning the parseRibEntry function in the pkg/packet/mrt/mrt.go file. Manipulating this function can lead to integer underflow, allowing for remote attacks.

Original NVD description (English source)

A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.