High severity · published May 4, 2026
CVE-2026-7737
osrg GoBGP BMP Parser bmp.go BMPStatisticsReport.ParseBody out-of-bounds
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
GoBGP · osrg
4.0; 4.1; 4.2; 4.3.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-7737
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-7737
Product
https://github.com/osrg/gobgp/
Patch
https://github.com/osrg/gobgp/commit/bc77597d42335c78464bc8e15a471d887bbdf260
Patch
https://github.com/osrg/gobgp/releases/tag/v4.4.0
Third Party Advisory
https://vuldb.com/submit/807605
Third Party Advisory
https://vuldb.com/vuln/360912
Permissions Required
https://vuldb.com/vuln/360912/cti
More from GoBGP
9.8
CVE-2025-43973
An issue was discovered in GoBGP before 3.35.0
7.5
CVE-2026-41643
GoBGP: Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE
7.5
CVE-2026-42285
GoBGP: Panic in AdjRib.Update via malformed BGP Update message (Nil Pointer Dereference)
7.5
CVE-2026-41642
GoBGP: Remote Denial of Service (Panic) via Malformed Well-known Path Attribute
7.5
CVE-2026-7736
osrg GoBGP mrt.go parseRibEntry integer underflow