CVE-2026-7734
Medium
Description
A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.
SeverityMedium
CVSS5.3
Exploit probability—
ProductOsrg Gobgp
PublishedMay 4, 2026
First seenMay 4, 2026
Weakness typeCWE-404CWE-404
How to fix
Update
- osrg gobgp4.4.0 or later
- github.com/osrg/gobgp/v44.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| osrg gobgp | v < 4.4.0 | 4.4.0 |
| github.com/osrg/gobgp/v4Go | v < 4.4.0 | 4.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.