CVE-2026-7734: Osrg GoBGP DOS Vulnerability

CVE-2026-7734 Overview

CVE-2026-7734 is a denial of service vulnerability in osrg GoBGP versions up to and including 4.3.0. The flaw resides in the SRv6L3ServiceAttribute.DecodeFromBytes function within pkg/packet/bgp/prefix_sid.go. When GoBGP decodes Segment Routing over IPv6 (SRv6) Layer 3 Service attributes containing unknown sub-TLV types, the parser enters an infinite loop. Remote attackers can trigger the condition by sending a crafted Border Gateway Protocol (BGP) update message. Exploitation does not require authentication or user interaction. Upgrading to version 4.4.0 resolves the issue through commit f9f7b55ec258e514be0264871fa645a2c3edad11.

Critical Impact
Remote unauthenticated attackers can cause GoBGP to enter an infinite loop, exhausting CPU resources and disrupting BGP routing operations.

Affected Products

osrg GoBGP versions up to 4.3.0
GoBGP pkg/packet/bgp/prefix_sid.go (SRv6 L3 Service component)
Network deployments using GoBGP for SRv6 routing

Discovery Timeline

2026-05-04 - CVE-2026-7734 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-7734

Vulnerability Analysis

The vulnerability is classified under [CWE-404] (Improper Resource Shutdown or Release) and manifests as an infinite loop during BGP attribute decoding. GoBGP is a Go-based open source BGP implementation used in software-defined networking and routing infrastructure. The defect lies in how the SRv6 L3 Service Attribute parser advances through nested sub-TLVs.

When the decoder encounters an unknown sub-TLV type, it falls into a default branch intended to skip the unrecognized element. The skip logic operates on the wrong buffer variable, so the parser never advances past the unknown TLV. The loop continues processing the same bytes indefinitely, consuming CPU cycles and blocking the BGP session goroutine.

Root Cause

The bug is a slice-handling error. The default case validated and sliced the outer data buffer instead of the inner stlvs buffer being iterated. As a result, the loop counter governing the iteration was never decremented, producing unbounded processing of the same input.

Attack Vector

An attacker capable of establishing or influencing a BGP session with a vulnerable GoBGP speaker can transmit a malformed BGP UPDATE containing an SRv6 L3 Service attribute with an unknown sub-TLV. The malformed message drives the receiving process into the infinite loop, degrading or halting BGP control-plane functionality. The attack requires network reachability to the BGP listener but no credentials.

// Patch: pkg/packet/bgp/prefix_sid.go
// Fix: infinite loop when decoding SRv6 unknown sub-TLV types
				SubSubTLVs: make([]PrefixSIDTLVInterface, 0),
 			}
 		default:
-			if len(data) < t.Len() {
+			if len(stlvs) < t.Len() {
 				return malformedAttrListErr("SRv6L3ServiceAttribute/SubTLV malformed")
 			}
-			data = data[t.Len():]
+			stlvs = stlvs[t.Len():]
 			continue
 		}

Source: GitHub Commit f9f7b55

Detection Methods for CVE-2026-7734

Indicators of Compromise

Sustained 100% CPU utilization on a single GoBGP process or goroutine without corresponding routing churn
BGP session timeouts, hold-timer expirations, or unresponsive control-plane API endpoints on GoBGP nodes
Inbound BGP UPDATE messages containing SRv6 L3 Service attributes with non-standard or unrecognized sub-TLV types
GoBGP versions at or below 4.3.0 listening on TCP/179 from untrusted peers

Detection Strategies

Inventory GoBGP deployments and flag any instance running version 4.3.0 or earlier using software composition analysis
Inspect BGP UPDATE traffic for SRv6 L3 Service Attribute (Path Attribute Type 40) sub-TLVs containing unknown type codes
Correlate process-level CPU spikes on routing nodes with concurrent BGP UPDATE volume from a single peer

Monitoring Recommendations

Enable BGP session state and hold-timer telemetry to alert on unexpected peer flaps
Capture per-process CPU and goroutine counts for the GoBGP daemon and forward to a centralized logging or SIEM platform
Log all BGP peers, including transient ones, and alert on peers sending malformed attribute errors

How to Mitigate CVE-2026-7734

Immediate Actions Required

Upgrade GoBGP to version 4.4.0 or later, which contains commit f9f7b55ec258e514be0264871fa645a2c3edad11
Restrict BGP peering to authenticated, trusted neighbors using TCP-AO or MD5 authentication and infrastructure ACLs
Apply BGP UPDATE filters to drop or sanitize SRv6 L3 Service attributes from peers that do not require SRv6 signaling
Restart GoBGP processes that show signs of CPU exhaustion after applying the patch

Patch Information

The fix is available in GoBGP 4.4.0. The patch corrects the slice manipulation in the default branch of the SRv6 L3 Service sub-TLV decoder so the loop properly advances past unknown TLV types. Refer to the GoBGP v4.4.0 Release Notes and the upstream commit.

Workarounds

Disable SRv6 address-family negotiation with untrusted BGP peers if SRv6 is not required
Place GoBGP speakers behind a route reflector or BGP-aware filter that strips Path Attribute 40 from external sessions
Apply network access controls to limit TCP/179 reachability to known peer IP addresses

bash

# Verify installed GoBGP version
gobgpd --version

# Upgrade using Go toolchain
go install github.com/osrg/gobgp/v4/cmd/gobgpd@v4.4.0
go install github.com/osrg/gobgp/v4/cmd/gobgp@v4.4.0

# Restrict BGP listener to trusted peer subnet (example iptables rule)
iptables -A INPUT -p tcp --dport 179 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 179 -j DROP