CVE-2026-7737
MEDIUM EPSS 45.7%
Published May 4, 20261mo ago · Modified Jun 17, 20261w ago
6.9 CVSS 4.0
Published May 4, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago
Description
A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
45.7% percentile
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 2
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer Memory Safety
CWE-125 Out-of-bounds Read Memory Safety
Affected Products 1
| Vendor | Product | Version | Range |
|---|---|---|---|
| osrg | gobgp | * | <4.4.0 |
References 6
- github.com https://github.com/osrg/gobgp/
- github.com https://github.com/osrg/gobgp/commit/bc77597d42335c78464bc8e15a471d887bbdf260
- github.com https://github.com/osrg/gobgp/releases/tag/v4.4.0
- vuldb.com https://vuldb.com/submit/807605
- vuldb.com https://vuldb.com/vuln/360912
- vuldb.com https://vuldb.com/vuln/360912/cti
Remediation
- github.com https://github.com/osrg/gobgp/commit/bc77597d42335c78464bc8e15a471d887bbdf260
- github.com https://github.com/osrg/gobgp/releases/tag/v4.4.0