{"id":"CVE-2026-7735","aliases":["DEBIAN-CVE-2026-7735","EUVD-2026-26915","GHSA-5jvq-55xj-6qff","UBUNTU-CVE-2026-7735","USN-8348-1"],"status":"published","title":"osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow","description":"A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00361,"percentile":0.30151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-120"],"published":"2026-05-04T05:15:11Z","modified":"2026-10-28T02:30:38Z","fixes":[{"ecosystem":"Debian:14","package":"gobgp","fixed_in":["4.4.0-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gobgp","fixed_in":["1.29-1ubuntu0.1+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gobgp","fixed_in":["2.12.0-1ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gobgp","fixed_in":["2.25.0-3ubuntu0.1+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gobgp","fixed_in":["3.23.0-1ubuntu0.3+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gobgp","fixed_in":["3.36.0-2ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.10.0-1","3.16.0-1","3.19.0-1","3.21.0-1","3.23.0-1","3.25.0-1","3.27.0-1","3.28.0-1","3.29.0-1","3.30.0-1","3.31.0-1","3.32.0-1","3.33.0-1","3.35.0-1","3.36.0-1","3.36.0-2","4.3.0-1","4.4.0-1","4.5.0-1","4.5.0-1~bpo13+1","4.6.0-1","4.6.0-2","4.6.0-2~bpo13+1","4.7.0-1","4.7.0-1~bpo13+1","4.8.0-1","4.8.0-1~bpo13+1","4.8.0-2~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.36.0-2","4.3.0-1","4.4.0-1","4.5.0-1","4.5.0-1~bpo13+1","4.6.0-1","4.6.0-2","4.6.0-2~bpo13+1","4.7.0-1","4.7.0-1~bpo13+1","4.8.0-1","4.8.0-1~bpo13+1","4.8.0-2~exp1"]},{"source":"osv","ecosystem":"Debian:14","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1"}]}],"versions":["3.36.0-2","4.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-1ubuntu0.1+esm2"}]}],"versions":["1.15-1","1.29-1","1.29-1ubuntu0.1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1ubuntu0.1~esm3"}]}],"versions":["1.33-1","2.11.0-1","2.12.0-1","2.12.0-1ubuntu0.1~esm1","2.12.0-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.0-3ubuntu0.1+esm4"}]}],"versions":["2.25.0-2","2.25.0-3","2.25.0-3build1","2.25.0-3ubuntu0.1","2.25.0-3ubuntu0.1+esm1","2.25.0-3ubuntu0.1+esm2","2.25.0-3ubuntu0.1+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.23.0-1ubuntu0.3+esm4"}]}],"versions":["3.16.0-1build1","3.19.0-1","3.21.0-1","3.23.0-1","3.23.0-1ubuntu0.1","3.23.0-1ubuntu0.2","3.23.0-1ubuntu0.2+esm1","3.23.0-1ubuntu0.3","3.23.0-1ubuntu0.3+esm1","3.23.0-1ubuntu0.3+esm2","3.23.0-1ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.35.0-1","3.36.0-2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-2ubuntu0.1~esm1"}]}],"versions":["3.36.0-2","3.36.0-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.29-1ubuntu0.1+esm2"}]}],"versions":["1.15-1","1.29-1","1.29-1ubuntu0.1+esm1"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.12.0-1ubuntu0.1~esm3"}]}],"versions":["1.33-1","2.11.0-1","2.12.0-1","2.12.0-1ubuntu0.1~esm1","2.12.0-1ubuntu0.1~esm2"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.0-3ubuntu0.1+esm4"}]}],"versions":["2.25.0-2","2.25.0-3","2.25.0-3build1","2.25.0-3ubuntu0.1","2.25.0-3ubuntu0.1+esm1","2.25.0-3ubuntu0.1+esm2","2.25.0-3ubuntu0.1+esm3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.23.0-1ubuntu0.3+esm4"}]}],"versions":["3.16.0-1build1","3.19.0-1","3.21.0-1","3.23.0-1","3.23.0-1ubuntu0.1","3.23.0-1ubuntu0.2","3.23.0-1ubuntu0.2+esm1","3.23.0-1ubuntu0.3","3.23.0-1ubuntu0.3+esm1","3.23.0-1ubuntu0.3+esm2","3.23.0-1ubuntu0.3+esm3"],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"gobgp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.36.0-2ubuntu0.1~esm1"}]}],"versions":["3.36.0-2","3.36.0-2build1"],"bundled":6}],"products":[{"vendor":"osrg","product":"gobgp"}],"references":[{"url":"https://vuldb.com/vuln/360910","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://vuldb.com/vuln/360910/cti","tags":["signature","permissions-required","Permissions Required","VDB Entry","report"]},{"url":"https://vuldb.com/submit/807600","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/osrg/gobgp/commit/51ad1ada06cb41ce47b7066799981816f50b7ced","tags":["patch","Patch","fix","report"]},{"url":"https://github.com/osrg/gobgp/releases/tag/v4.4.0","tags":["patch","Patch","Product","fix"]},{"url":"https://github.com/osrg/gobgp/","tags":["product","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7735","tags":["advisory"]},{"url":"https://github.com/osrg/gobgp"},{"url":"https://github.com/advisories/GHSA-5jvq-55xj-6qff","tags":["report"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7735.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-7735","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-7735","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7735","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8348-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-7734","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-7736","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-7737","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-37461","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-41643","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-7735","title":"osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow","description":"A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.","status":"published","published":"2026-05-04T05:15:11.921Z","modified":"2026-05-04T12:49:04.665Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","level":"medium","assessor":"cna"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C","level":"high","assessor":"cna"},{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C","level":"high","assessor":"cna"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C","assessor":"cna"}],"cwes":["CWE-120","CWE-119"],"updated_at":"2026-11-02T14:20:06.216584Z"}],"euvd":[{"id":"EUVD-2026-26915","description":"A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.","status":"published","published":"2026-05-04T05:15:11Z","modified":"2026-05-04T12:49:04Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","level":"medium"}],"updated_at":"2026-11-02T19:05:18.340967Z"}],"ghsa":[{"id":"GHSA-5jvq-55xj-6qff","title":"A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp...","description":"A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.","status":"published","published":"2026-05-04T06:32:02Z","modified":"2026-05-04T06:32:07Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:07:54.172768Z"}],"nvd":[{"id":"CVE-2026-7735","description":"A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.","status":"published","published":"2026-05-04T06:16:02.367Z","modified":"2026-10-26T19:10:00.163Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"secondary"}],"cwes":["CWE-119","CWE-120"],"updated_at":"2026-11-02T14:12:17.022502Z"}],"osv":[{"id":"CVE-2026-7735","title":"osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow","description":"A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.","status":"published","published":"2026-05-04T05:15:11.921Z","modified":"2026-10-28T02:30:38.284072593Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","level":"medium"}],"cwes":["CWE-119","CWE-120"],"updated_at":"2026-11-02T15:45:17.102988Z"},{"id":"DEBIAN-CVE-2026-7735","description":"A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.","status":"published","published":"2026-05-04T06:16:02.367Z","modified":"2026-10-27T10:02:16.009975854Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:46:03.502256Z"},{"id":"UBUNTU-CVE-2026-7735","description":"A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.","status":"published","published":"2026-05-04T06:16:00Z","modified":"2026-06-03T09:15:14.719387339Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:57:13.483205Z"},{"id":"USN-8348-1","title":"gobgp vulnerabilities","description":"It was discovered that GoBGP incorrectly handled certain specially crafted\nBGP UPDATE messages. A remote attacker could possibly use this issue to\ncause GoBGP to crash, resulting in a denial of service. (CVE-2026-37461)\n\nYanlei Wang discovered that GoBGP incorrectly handled certain malformed BGP\nUPDATE messages containing 4-byte AS attributes. A remote attacker could\npossibly use this issue to cause GoBGP to crash, resulting in a denial of\nservice. (CVE-2026-41643)\n\nIt was discovered that GoBGP incorrectly handled certain malformed BGP\nUPDATE messages containing SRv6 L3 Service attributes. A remote attacker\ncould possibly use this issue to cause GoBGP to crash, resulting in a\ndenial of service. (CVE-2026-7734)\n\nIt was discovered that GoBGP incorrectly handled certain malformed BGP\nUPDATE messages containing Accumulated IGP (AIGP) attributes. A remote\nattacker could possibly use this issue to cause GoBGP to crash, resulting\nin a denial of service. (CVE-2026-7735)\n\nIt was discovered that GoBGP incorrectly handled certain malformed Multi-\nthreaded Routing Toolkit (MRT) routing information entries. A remote\nattacker could possibly use this issue to cause GoBGP to crash, resulting\nin a denial of service. (CVE-2026-7736)\n\nIt was discovered that GoBGP incorrectly handled certain malformed Multi-\nthreaded Routing Toolkit (MRT) headers. A remote attacker could possibly\nuse this issue to cause GoBGP to crash, resulting in a denial of service.\n(CVE-2026-7737)","status":"published","published":"2026-06-03T04:50:51Z","modified":"2026-06-03T14:03:58.335042416Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}