CVE-2026-7735 Details
Description
A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.
A buffer overflow vulnerability has been identified in osrg GoBGP versions through 4.3.0. The issue arises in the AIGP Attribute Parser, specifically within the PathAttributeAigp.DecodeFromBytes function in pkg/packet/bgp/bgp.go. The vulnerability can be exploited remotely by manipulating the AIGP path attribute parsing, leading to a buffer overflow condition.
Users can upgrade to GoBGP version 4.4.0 or later to address this vulnerability. Version 4.4.0 is available as a binary release and can be downloaded from the GoBGP GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/osrg/gobgp/ | [email protected] | Product |
| https://github.com/osrg/gobgp/commit/51ad1ada06cb41ce47b7066799981816f50b7ced | [email protected] | Patch |
| https://github.com/osrg/gobgp/releases/tag/v4.4.0 | [email protected] | PatchProduct |
| https://vuldb.com/submit/807600 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/360910 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/360910/cti | [email protected] | Permissions RequiredVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| osrg gobgp | < 4.4.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | New CVE Received | [email protected] |