CVE-2026-7734Medium· 5.3▾ SunlitGoBGP has an Improper Resource Shutdown or Release
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.5%
A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. Users should upgrade the affected component.
github.com/osrg/gobgp/v4 < 4.4.0Upgrade to a patched release:
github.com/osrg/gobgp/v4 4.4.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-41642High· 7.5github.com/osrg/gobgp: GoBGP: Denial of Service via malformed BGP UPDATE message (CVE-2026-41642)
CVE-2026-7736High· 7.3GoBGP has an Integer Underflow Issue
CVE-2026-30405High· 7.5GoBGP vulnerable to a denial of service via the NEXT_HOP path attribute
CVE-2026-37462High· 7.3GoBGP: Integer underflow in the BGPUpdate.DecodeFromBytes function
CVE-2026-42285High· 7.5github.com/osrg/gobgp: GoBGP: Denial of Service due to specially crafted BGP UPDATE message (CVE-2026-42285)
CVE-2026-41643High· 7.5GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE