CVE-2026-7735 osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow

What is CVE-2026-7735?

CVE-2026-7735 is a medium-severity memory corruption vulnerability in osrg GoBGP, published on 4 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.

Weakness: CWE-120, CWE-119

Which versions are affected by CVE-2026-7735?

It affects 1 product.

Products include Osrg Gobgp.

How do I fix CVE-2026-7735?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-7735 being exploited?

There is no known exploitation of CVE-2026-7735 in the wild and no public exploit code.

Other vulnerabilities in osrg GoBGP

• CVE-2025-43971 GoBGP panics due to a zero value for softwareVersionLen High 8.6
• CVE-2026-41642 GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute High 7.5
• CVE-2026-41643 GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE High 7.5
• CVE-2026-42285 GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference) High 7.5
• CVE-2026-37461 GoBGP has an out-of-bounds read in the ParseIP6Extended function High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-7735, GHSA-5jvq-55xj-6qff, UBUNTU-CVE-2026-7735.