CVE-2026-7736: fallo de gravedad media en osrg GoBGP
osrg GoBGP mrt.go parseRibEntry integer underflow
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.9epss 0.5%
A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing a manipulation can lead to integer underflow. It is possible to launch the attack remotely. Upgrading to version 4.4.0 addresses this issue. This patch is called 76d911046344a3923cbe573364197aa081944592. It is suggested to upgrade the affected component.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Productos afectados
osrg · GoBGPCVEs relacionadas — osrg GoBGP
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-7737MEDIUMosrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-boundsEPSS 0.6%CVE-2025-7464MEDIUMosrg GoBGP rtr.go SplitRTR out-of-boundsEPSS 0.5%CVE-2026-7734MEDIUMosrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of serviceEPSS 0.5%CVE-2026-5123MEDIUMosrg GoBGP bgp.go DecodeFromBytes off-by-oneEPSS 0.4%CVE-2026-7735MEDIUMosrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflowEPSS 0.4%CVE-2026-5124MEDIUMosrg GoBGP BGP Header bgp.go BGPHeader.DecodeFromBytes access controlEPSS 0.3%