Login Request a demo
High severity · published May 4, 2026
CVE-2026-7734
osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
GoBGP · osrg
4.0; 4.1; 4.2; 4.3.0 · source: vendor, NVD
Affected product
GO
GoBGP
osrg
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7734
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7734
Product
https://github.com/osrg/gobgp/
Patch
https://github.com/osrg/gobgp/commit/f9f7b55ec258e514be0264871fa645a2c3edad11
Patch
https://github.com/osrg/gobgp/releases/tag/v4.4.0
Third Party Advisory
https://vuldb.com/submit/807581
Third Party Advisory
https://vuldb.com/vuln/360909
Permissions Required
https://vuldb.com/vuln/360909/cti
More from GoBGP
9.8
CVE-2025-43973
An issue was discovered in GoBGP before 3.35.0
7.5
CVE-2026-41643
GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
7.5
CVE-2026-42285
GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
7.5
CVE-2026-41642
GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
7.5
CVE-2026-7737
osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds