CVE-2026-7737: Osrg GoBGP Buffer Overflow Vulnerability

CVE-2026-7737 Overview

CVE-2026-7737 is an out-of-bounds read vulnerability in osrg GoBGP up to version 4.3.0. The flaw resides in the BMPPeerUpNotification.ParseBody and BMPStatisticsReport.ParseBody functions in pkg/packet/bmp/bmp.go, part of the BGP Monitoring Protocol (BMP) parser component. An attacker can trigger the issue remotely by sending a malformed BMP message that lacks sufficient bytes for the parser's expected fields. The vulnerability is tracked under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). Upgrading to version 4.4.0 resolves the issue, with the fix delivered in commit bc77597d42335c78464bc8e15a471d887bbdf260.

Critical Impact
Remote attackers can send crafted BMP messages to trigger out-of-bounds reads in GoBGP, leading to denial of service of the BGP monitoring infrastructure.

Affected Products

osrg GoBGP versions up to and including 4.3.0
GoBGP deployments exposing the BMP listener to untrusted networks
Network monitoring stacks consuming BMP feeds via GoBGP libraries

Discovery Timeline

2026-05-04 - CVE-2026-7737 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-7737

Vulnerability Analysis

GoBGP implements the BGP Monitoring Protocol (BMP) to relay BGP session state and statistics to external collectors. The ParseBody methods for BMPPeerUpNotification and BMPStatisticsReport read fixed-size fields from the input byte slice without first validating that enough bytes are present. When the parser receives a truncated message, the slice index expression reads past the end of the buffer.

The vulnerability is a classic out-of-bounds read driven by missing length validation. The attack vector is network-based, requires no privileges, and no user interaction. Successful exploitation impacts availability by crashing the GoBGP process or the consumer using the BMP parsing library. Confidentiality and integrity are not affected.

Root Cause

The parsers assumed a minimum body length without verifying it. In BMPStatisticsReport.ParseBody, the code called binary.BigEndian.Uint32(data[:4]) directly. When data contained fewer than 4 bytes, the slice expression triggered a runtime panic in Go. The companion function BMPPeerUpNotification.ParseBody exhibited the same pattern on its fixed-size fields.

Attack Vector

An unauthenticated attacker reachable by the GoBGP BMP listener sends a BMP message with a valid header but a truncated body. When GoBGP dispatches the message to the affected ParseBody function, the unchecked slice read causes a panic and terminates the goroutine or process handling BMP traffic.

// Security patch in pkg/packet/bmp/bmp.go
// Source: https://github.com/osrg/gobgp/commit/bc77597d42335c78464bc8e15a471d887bbdf260
func (body *BMPStatisticsReport) ParseBody(msg *BMPMessage, data []byte, options ...*bgp.MarshallingOption) error {
    if len(data) < 4 {
        return fmt.Errorf("BMP Statistics Report body too short: %d bytes", len(data))
    }
    body.Count = binary.BigEndian.Uint32(data[:4])
    data = data[4:]
    for len(data) >= 4 {
        // ...
    }
}

The fix adds an explicit length guard before reading the Count field and returns a descriptive error rather than panicking on undersized input.

Detection Methods for CVE-2026-7737

Indicators of Compromise

Unexpected GoBGP process restarts or crash logs referencing runtime error: slice bounds out of range in pkg/packet/bmp/bmp.go
BMP session resets initiated from external peers immediately followed by GoBGP termination
Inbound TCP connections to the BMP listener (default port 11019) from unexpected source addresses

Detection Strategies

Inspect GoBGP application logs for Go panic stack traces involving BMPPeerUpNotification.ParseBody or BMPStatisticsReport.ParseBody
Compare deployed GoBGP versions against 4.4.0 using software inventory queries against the osrg:gobgp component
Monitor BMP message length fields against expected minimums and alert on truncated bodies at the network layer

Monitoring Recommendations

Track availability metrics on GoBGP daemons and alert on abnormal restart frequency
Capture and retain BMP traffic samples for forensic analysis when crashes occur
Restrict and log access to BMP TCP ports through host-based firewall telemetry

How to Mitigate CVE-2026-7737

Immediate Actions Required

Upgrade GoBGP to version 4.4.0 or later, which contains commit bc77597d42335c78464bc8e15a471d887bbdf260
Audit all systems and Go modules importing github.com/osrg/gobgp and rebuild dependent binaries against the patched release
Restrict BMP listener exposure to trusted management networks until the upgrade is complete

Patch Information

The fix is published in GoBGP release v4.4.0 and the underlying security commit bc77597d. The patch validates the BMP message body length before parsing fixed-size fields and returns an error on truncated input.

Workarounds

Place the GoBGP BMP listener behind an access control list permitting only known BMP clients
Terminate BMP sessions inside a TLS or IPsec tunnel that authenticates peers before traffic reaches the parser
Run GoBGP under a process supervisor that contains crash impact and preserves panic logs for triage

bash

# Verify installed GoBGP version and restrict BMP exposure
gobgpd -v

# Example iptables rule limiting BMP listener (TCP/11019) to a trusted collector
iptables -A INPUT -p tcp --dport 11019 -s 10.0.0.10 -j ACCEPT
iptables -A INPUT -p tcp --dport 11019 -j DROP