CVE-2026-7735
High
Description
A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.
SeverityHigh
CVSS7.3
Exploit probability—
ProductOsrg Gobgp
PublishedMay 4, 2026
First seenMay 4, 2026
Weakness typeCWE-120CWE-120CWE-119Memory buffer bounds error
How to fix
Update
- osrg gobgp4.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| osrg gobgp | v < 4.4.0 | 4.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.