CVE-2026-7735CWE-119CWE-120

osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow

Medium · published May 4, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
48.7
In the wild
Unconfirmed
What it is

A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00614 · 48.7th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Published
2026-05-04T05:15Z
EPSS history
Timeline
  • 04 MAY 05:15Z
    osrg GoBGP AIGP Attribute bgp.go PathAttributeAigp.DecodeFromBytes buffer overflow
    cvelistv5