High severity · published May 4, 2026
CVE-2026-7735
osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow
7.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
GoBGP · osrg
4.0; 4.1; 4.2; 4.3.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7735
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7735
Product
https://github.com/osrg/gobgp/
Patch
https://github.com/osrg/gobgp/commit/51ad1ada06cb41ce47b7066799981816f50b7ced
Patch
https://github.com/osrg/gobgp/releases/tag/v4.4.0
Third Party Advisory
https://vuldb.com/submit/807600
Third Party Advisory
https://vuldb.com/vuln/360910
Permissions Required
https://vuldb.com/vuln/360910/cti
More from GoBGP
9.8
CVE-2025-43973
An issue was discovered in GoBGP before 3.35.0
7.5
CVE-2026-41643
GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
7.5
CVE-2026-42285
GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
7.5
CVE-2026-41642
GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
7.5
CVE-2026-7737
osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds