CVE-2026-7735: Osrg GoBGP Buffer Overflow Vulnerability

CVE-2026-7735 Overview

CVE-2026-7735 is a buffer overflow vulnerability in osrg GoBGP through version 4.3.0. The flaw resides in the PathAttributeAigp.DecodeFromBytes function within pkg/packet/bgp/bgp.go, part of the Accumulated IGP (AIGP) Attribute Parser. A remote attacker can trigger the issue by sending a crafted Border Gateway Protocol (BGP) update message containing a malformed AIGP attribute. The vulnerability is classified under [CWE-119] for improper restriction of operations within memory buffer bounds. GoBGP is a widely deployed open-source BGP implementation written in Go, used in software-defined networking and route server deployments. Upgrading to version 4.4.0 resolves the issue.

Critical Impact
Remote attackers can exploit malformed AIGP TLV length fields to trigger memory corruption in BGP daemons, potentially disrupting routing infrastructure without authentication.

Affected Products

osrg GoBGP versions up to and including 4.3.0
Components using pkg/packet/bgp/bgp.go AIGP Attribute Parser
BGP routing deployments leveraging GoBGP as a daemon or library

Discovery Timeline

2026-05-04 - CVE-2026-7735 published to NVD
2026-05-06 - Last updated in NVD database
Patch commit - 51ad1ada06cb41ce47b7066799981816f50b7ced released in GoBGP v4.4.0

Technical Details for CVE-2026-7735

Vulnerability Analysis

The vulnerability stems from improper validation of Type-Length-Value (TLV) fields when parsing AIGP path attributes in BGP UPDATE messages. The original DecodeFromBytes implementation used break statements when encountering inconsistent length fields, silently truncating parsing instead of returning protocol errors. This permitted malformed attribute streams to bypass length validation. The Exploit Prediction Scoring System (EPSS) currently rates exploitation likelihood at 0.053%, reflecting limited active interest. However, BGP-adjacent attackers operating compromised peers could weaponize the flaw to disrupt routing daemons.

Root Cause

The parser failed to enforce strict bounds checking between the declared TLV length field and the remaining buffer size. When len(value) < int(length), the code previously executed break rather than returning a BGP_ERROR_UPDATE_MESSAGE_ERROR. Similarly, undersized AIGP_TLV_IGP_METRIC entries (less than 8 bytes) were silently skipped. These permissive flows allowed memory operations to proceed against attacker-controlled length values.

Attack Vector

Exploitation requires the attacker to send a crafted BGP UPDATE message containing a malformed AIGP attribute to a vulnerable GoBGP instance. The attack is network-reachable, requires no authentication beyond establishing a BGP session, and requires no user interaction. In practical deployments, this requires either a misconfigured peer, a compromised neighboring autonomous system, or an internet-exposed BGP daemon.

// Patch from commit 51ad1ada06cb41ce47b7066799981816f50b7ced
// pkg/packet/bgp/bgp.go - AIGP PathAttribute parser fix
	if err != nil {
		return err
	}
+	var values []AigpTLVInterface
	for len(value) > 3 {
		typ := value[0]
		length := binary.BigEndian.Uint16(value[1:3])
		if length <= 3 {
			return NewMessageError(BGP_ERROR_MESSAGE_HEADER_ERROR, BGP_ERROR_SUB_BAD_MESSAGE_LENGTH, nil, "Malformed BGP message")
		}
		if len(value) < int(length) {
-			break
+			return NewMessageError(BGP_ERROR_UPDATE_MESSAGE_ERROR, BGP_ERROR_SUB_MALFORMED_ATTRIBUTE_LIST, nil, "Aigp TLV length exceeds remaining data")
		}
		v := value[3:length]
		switch AigpTLVType(typ) {
		case AIGP_TLV_IGP_METRIC:
			if len(v) < 8 {
-				break
+				return NewMessageError(BGP_ERROR_UPDATE_MESSAGE_ERROR, BGP_ERROR_SUB_MALFORMED_ATTRIBUTE_LIST, nil, "Aigp IGP Metric TLV is too short")
			}
			metric := binary.BigEndian.Uint64(v)
-			p.Values = append(p.Values, NewAigpTLVIgpMetric(metric))
+			values = append(values, NewAigpTLVIgpMetric(metric))
		default:
-			p.Values = append(p.Values, NewAigpTLVDefault(AigpTLVType(typ), v))
+			values = append(values, NewAigpTLVDefault(AigpTLVType(typ), v))
		}
		value = value[length:]
	}

Source: GitHub GoBGP Commit 51ad1ad

Detection Methods for CVE-2026-7735

Indicators of Compromise

Unexpected GoBGP daemon crashes or restarts coinciding with received BGP UPDATE messages
BGP session resets from peers immediately following AIGP attribute exchanges
Anomalous panic traces or stack dumps referencing PathAttributeAigp.DecodeFromBytes
Inbound BGP UPDATE messages containing AIGP attributes with TLV length fields exceeding the actual payload

Detection Strategies

Capture BGP traffic with packet inspection tools and validate AIGP TLV length fields against the remaining attribute buffer
Monitor process telemetry for gobgpd crash signatures and restart loops
Inspect BGP session logs for repeated NOTIFICATION messages tied to malformed attribute lists

Monitoring Recommendations

Enable verbose BGP message logging on GoBGP instances to capture malformed attribute events
Alert on BGP session flaps from peers that have not historically sent AIGP attributes
Track GoBGP version inventory across infrastructure to identify hosts running 4.3.0 or earlier

How to Mitigate CVE-2026-7735

Immediate Actions Required

Upgrade GoBGP to version 4.4.0 or later, which contains commit 51ad1ada06cb41ce47b7066799981816f50b7ced
Audit BGP peer configurations and restrict sessions to authenticated, trusted neighbors
Apply BGP TCP-AO or MD5 authentication on all BGP sessions where supported

Patch Information

The fix is available in GoBGP Release v4.4.0. The patch returns explicit BGP_ERROR_UPDATE_MESSAGE_ERROR responses when AIGP TLV length fields exceed remaining buffer data or when AIGP_TLV_IGP_METRIC entries are undersized. Operators rebuilding from source should pull commit 51ad1ad and rebuild downstream binaries and container images.

Workarounds

Restrict BGP sessions to internal, trusted peers using firewall rules limiting TCP port 179 access
Deploy BGP route filters and inbound attribute filtering at upstream routers to drop unsolicited AIGP attributes
Where feasible, disable AIGP attribute processing on GoBGP instances that do not require it

bash

# Verify installed GoBGP version and upgrade
gobgpd --version

# Rebuild from patched source
git clone https://github.com/osrg/gobgp.git
cd gobgp
git checkout v4.4.0
go build ./cmd/gobgpd

# Restrict BGP peer access via iptables (example)
iptables -A INPUT -p tcp --dport 179 -s <trusted_peer_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 179 -j DROP