VulnerabilityAnalyzed

CVE-2026-7735

A vulnerability was found in osrg GoBGP up to 4.3.0.

MEDIUM 6.9EPSS 0.36%

Does this matter?

Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.

Description

A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.

CVSS 4.0: 6.9 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.36% probability · 30th percentile
CISA KEV: Not listed
Weakness: CWE-119, CWE-120
Affected: osrg/gobgp
Source: cna@vuldb.com

References

https://github.com/osrg/gobgp/Product
https://github.com/osrg/gobgp/commit/51ad1ada06cb41ce47b7066799981816f50b7cedPatch
https://github.com/osrg/gobgp/releases/tag/v4.4.0Patch, Product
https://vuldb.com/submit/807600Third Party Advisory, VDB Entry
https://vuldb.com/vuln/360910Third Party Advisory, VDB Entry
https://vuldb.com/vuln/360910/ctiPermissions Required, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.