PT-2026-36780 · Osrg · Gobgp

Sunxj · Published 2026-05-04 · Updated 2026-05-04 · CVE-2026-7737

NVD

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.

Fix

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125

CWE-119

Related Identifiers

CVE-2026-7737

Affected Products

Gobgp

References · 7

• https://github.com/osrg/gobgp/commit/bc77597d42335c78464bc8e15a471d887bbdf260 · Patch
• https://github.com/osrg/gobgp/releases/tag/v4.4.0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7737 · Security Note
• https://github.com/osrg/gobgp · Note
• https://vuldb.com/vuln/360912/cti · Note
• https://vuldb.com/submit/807605 · Note
• https://vuldb.com/vuln/360912 · Note