CVE-2026-7735 - osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow

Back Back to CVE browser

MEDIUM

osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow

Published May 4, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.61%

Description

A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.

Affected products

Vendor Osrg Product GoBGP Default
n/a
- Version
  4.0
  Status
  affected
  Constraints
  -
- Version
  4.1
  Status
  affected
  Constraints
  -
- Version
  4.2
  Status
  affected
  Constraints
  -
- Version
  4.3.0
  Status
  affected
  Constraints
  -
- Version
  4.4.0
  Status
  unaffected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Osrg

GoBGP

n/a

Version	Status	Constraints
4.0	affected	-
4.1	affected	-
4.2	affected	-
4.3.0	affected	-
4.4.0	unaffected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-120

Classic Buffer Overflow

References (7)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26915
Advisory
https://github.com/osrg/gobgp/
product
https://github.com/osrg/gobgp/commit/51ad1ada06cb41ce47b7066799981816f50b7ced
patch
https://github.com/osrg/gobgp/releases/tag/v4.4.0
patchProduct
https://vuldb.com/submit/807600
third-party-advisoryThird Party AdvisoryVDB Entry
https://vuldb.com/vuln/360910
vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/vuln/360910/cti
signaturepermissions-requiredPermissions RequiredVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26915		Advisory
https://github.com/osrg/gobgp/		product
https://github.com/osrg/gobgp/commit/51ad1ada06cb41ce47b7066799981816f50b7ced		patch
https://github.com/osrg/gobgp/releases/tag/v4.4.0		patchProduct
https://vuldb.com/submit/807600		third-party-advisoryThird Party AdvisoryVDB Entry
https://vuldb.com/vuln/360910		vdb-entrytechnical-descriptionThird Party AdvisoryVDB Entry
https://vuldb.com/vuln/360910/cti		signaturepermissions-requiredPermissions RequiredVDB Entry