CVE-2026-7736mediumCWE-189CWE-191

CVE-2026-7736: medium-severity vulnerability in osrg GoBGP

osrg GoBGP mrt.go parseRibEntry integer underflow

Published

Follow this CVE+ Monitor GoBGP+ Monitor gobgp

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.5%
A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing a manipulation can lead to integer underflow. It is possible to launch the attack remotely. Upgrading to version 4.4.0 addresses this issue. This patch is called 76d911046344a3923cbe573364197aa081944592. It is suggested to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Affected products
osrg · GoBGP
Related CVEs — osrg GoBGP

In the same product, most dangerous first.

CVE-2026-7737MEDIUMosrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-boundsEPSS 0.6%CVE-2025-7464MEDIUMosrg GoBGP rtr.go SplitRTR out-of-boundsEPSS 0.5%CVE-2026-7734MEDIUMosrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of serviceEPSS 0.5%CVE-2026-5123MEDIUMosrg GoBGP bgp.go DecodeFromBytes off-by-oneEPSS 0.4%CVE-2026-7735MEDIUMosrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflowEPSS 0.4%CVE-2026-5124MEDIUMosrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access controlEPSS 0.3%