Dashboard / CVE-2026-7735

CVE-2026-7735

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 74/100
Published: 2026-05-04 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: None
S: X
AT: None
VC: Low
VI: Low
VA: Low

Description

A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.

Weakness Classification (2)

Affected Software (1)

VendorProductVersion
osrg gobgp < 4.4.0

References & Advisories (6)

https://vuldb.com/submit/807600
Third Party Advisory VDB Entry
https://vuldb.com/vuln/360910
Third Party Advisory VDB Entry
https://vuldb.com/vuln/360910/cti
Permissions Required VDB Entry

Bug Bounty Relevance

74 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.36%
Raw Score 0.003610
Percentile 29.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00361
2026-10-28
0.00361

Intelligence Sources

nvd ref →

External Links