Vulnerability · Published May 4, 2026 · Assigned by VulDB
CVE-2026-7734osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service
Medium 5.3
In plain English
A medium-severity security flaw in GoBGP from osrg. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | gobgp | no fix listed | DEBIAN-CVE-2026-7734 |
| Debian:13 | gobgp | no fix listed | DEBIAN-CVE-2026-7734 |
| Debian:14 | gobgp | 4.4.0-1 | DEBIAN-CVE-2026-7734 |
| Go | github.com/osrg/gobgp/v4 | 4.4.0 | GHSA-vm3g-8xwv-mxfp |
| Go | github.com/osrg/gobgp/v4 | 4.4.0 | GO-2026-5665 |
| Ubuntu:25.10 | gobgp | no fix listed | UBUNTU-CVE-2026-7734 |
Affected products (as reported)
Weakness: CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
References
- VDB-360909 | osrg GoBGP SRv6 L3 Service prefix_sid.go SRv6L3ServiceAttribute.DecodeFromBytes denial of service vdb-entry, technical-description
- VDB-360909 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #807581 | GoBGP 4.3.0 Infinite Loop third-party-advisory
- https://github.com/osrg/gobgp/commit/f9f7b55ec258e514be0264871fa645a2c3edad11 patch
- https://github.com/osrg/gobgp/releases/tag/v4.4.0 patch
- https://github.com/osrg/gobgp/ product