CVE-2026-7734: GoBGP SRv6 L3 Service Denial of Service Vulnerability
Summary
CVE-2026-7734: GoBGP has an Improper Resource Shutdown or Release. Affects github.com/osrg/gobgp/v4 versions < 4.4.0. Fixed in 4.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) written in Go. It is designed to provide a flexible and extensible platform for managing BGP routing. The package supports various features, including SRv6 (Segment Routing over IPv6), which enhances the routing capabilities of networks. However, versions up to 4.3.0 are vulnerable to a denial of service attack due to improper resource shutdown or release in the SRv6 L3 Service component.
Vulnerability Detail
A vulnerability has been identified in GoBGP versions up to 4.3.0, specifically in the SRv6L3ServiceAttribute.DecodeFromBytes function located in the pkg/packet/bgp/prefix_sid.go file. This vulnerability allows an attacker to manipulate the argument data, leading to a denial of service. The attack can be executed remotely, potentially disrupting the service for users. The vulnerability is classified under CWE-404, indicating improper resource shutdown or release, which can result in service unavailability.
How To Fix
Latest published version: v4.10.0 as of 22 Oct 2026
go get github.com/osrg/gobgp/v4@v4.10.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.4.0
This is the first release that contains the fix.
go get github.com/osrg/gobgp/v4@v4.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds are provided for this vulnerability. The recommended action is to upgrade to the patched version.
Conclusion
In summary, CVE-2026-7734 is a denial of service vulnerability found in GoBGP versions up to 4.3.0, affecting the SRv6 L3 Service component. Users are advised to upgrade to version 4.4.0 to mitigate the risk. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for github.com/osrg/gobgp/v4 →
FAQ
The impact includes potential denial of service, which can disrupt network operations and affect users relying on GoBGP for routing.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
GoBGP versions up to 4.3.0 are affected by this vulnerability.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
Yes, upgrading to GoBGP version 4.4.0 or later will fix the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/osrg/gobgp/v4.
