CVE-2026-7737: GoBGP Improper Restriction of Operations within the Bounds of a Memory Buffer
Summary
CVE-2026-7737: GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer. Affects github.com/osrg/gobgp versions < 4.4.0. Fixed in 4.4.0. How to fix ↓
Also tracked for
The same CVE-2026-7737 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GoBGP is an open-source implementation of the Border Gateway Protocol (BGP) written in Go. It is designed to provide a flexible and extensible platform for BGP routing, allowing users to manage and monitor BGP sessions effectively. The package is widely used in networking applications and supports various features, including route management and monitoring. However, a vulnerability has been identified in GoBGP that affects its BMP (BGP Monitoring Protocol) Parser, which could lead to security risks if not addressed.
Vulnerability Detail
A vulnerability was identified in osrg GoBGP versions up to 4.3.0, specifically in the BMPPeerUpNotification.ParseBody and BMPStatisticsReport.ParseBody functions located in pkg/packet/bmp/bmp.go. This issue allows for out-of-bounds read operations, which can be exploited remotely by an attacker. The potential ramifications include unauthorized access to sensitive data or application crashes, making it crucial for users to upgrade to the patched version to mitigate these risks.
How To Fix
Minimum fixed version
4.4.0
This is the first release that contains the fix.
go get github.com/osrg/gobgp@v4.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
In summary, CVE-2026-7737 is a significant vulnerability in GoBGP that requires immediate attention. Users should upgrade to version 4.4.0 or later to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for github.com/osrg/gobgp →
FAQ
CVE-2026-7737 is a vulnerability in GoBGP that allows for improper restriction of operations within the bounds of a memory buffer, leading to potential out-of-bounds read issues.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors and alerts for open-source vulnerabilities in real-time.
The vulnerability can lead to unauthorized access to sensitive data or application crashes, posing security risks to users.
Yes, upgrading to GoBGP version 4.4.0 or later will resolve the vulnerability.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in software using just the Gopkg.lock file, providing real-time insights without requiring code access or installation.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/osrg/gobgp.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
