CVE-2026-7735: 
NixOS vulnerability analysis and mitigation

CVE-2026-7735 is a buffer overflow vulnerability in the AIGP (Accumulated IGP Metric) Attribute Parser of osrg GoBGP, an open-source BGP implementation written in Go. The flaw exists in the PathAttributeAigp.DecodeFromBytes function within pkg/packet/bgp/bgp.go, where improper error handling allows a buffer overflow condition to be triggered via crafted BGP packets. All GoBGP versions up to and including 4.3.0 are affected; version 4.4.0 resolves the issue. The vulnerability was published on May 4, 2026, with a CVSS v3.1 score of 7.3 (High) and a CVSS v4.0 score of 6.9 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-120 (Buffer Copy without Checking Size of Input). In the vulnerable code, the AIGP TLV parsing loop used a break statement instead of returning an error when the declared TLV length field exceeded the remaining data buffer, and similarly silently skipped malformed IGP Metric TLVs rather than rejecting them. This allowed partially parsed values to be appended to p.Values even when the input was malformed, creating a buffer over-read condition. The fix (commit 51ad1ada06cb41ce47b7066799981816f50b7ced) replaces the silent break statements with explicit NewMessageError returns and defers assignment to p.Values until parsing completes successfully (GoBGP Commit). Exploitation requires no authentication and no user interaction — an attacker only needs network access to a GoBGP BGP peer endpoint (Github Advisory).

Successful exploitation can result in low-level impacts to confidentiality, integrity, and availability of the affected GoBGP instance. An attacker could trigger information disclosure (e.g., memory content leakage), data corruption within the BGP routing process, or denial of service by crashing or destabilizing the GoBGP daemon. Because GoBGP is used in network routing infrastructure, disruption of the BGP process could affect routing table stability and network availability for dependent systems (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit code known at this time, and no evidence of in-the-wild exploitation has been reported (Github Advisory). The EPSS score is approximately 0.058% (23rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified. Despite the lack of a PoC, the unauthenticated, network-accessible attack vector lowers the barrier for exploitation by any BGP peer with connectivity to a vulnerable GoBGP instance.

1. Reconnaissance: Identify network-accessible GoBGP instances running versions ≤ 4.3.0. BGP typically listens on TCP port 179; scanning for open port 179 with tools like Nmap or Shodan can help identify candidates.
2. Establish BGP peering: Initiate a BGP session with the target GoBGP instance. This may require being in a position to act as a BGP peer (e.g., on the same network segment or via a compromised adjacent router).
3. Craft malicious BGP UPDATE: Construct a BGP UPDATE message containing a malformed AIGP path attribute where the TLV length field is set to a value exceeding the actual remaining data in the packet, or where the IGP Metric TLV payload is shorter than the required 8 bytes.
4. Send the malformed packet: Transmit the crafted BGP UPDATE to the target. The vulnerable PathAttributeAigp.DecodeFromBytes function will encounter the malformed TLV and, instead of returning an error, silently continue parsing out-of-bounds memory.
5. Trigger impact: Depending on memory layout, the result may be a process crash (DoS), memory disclosure, or data corruption within the GoBGP routing process (GoBGP Commit, Github Advisory).

• Network: Unexpected or unauthorized BGP session establishment attempts on TCP port 179 from unknown peers; BGP UPDATE messages containing AIGP path attributes with anomalous or oversized TLV length fields.
• Logs: GoBGP daemon logs showing parsing errors or unexpected crashes related to AIGP attribute processing; Go runtime panic stack traces referencing PathAttributeAigp.DecodeFromBytes in pkg/packet/bgp/bgp.go.
• Process: Unexpected termination or restart of the GoBGP process (gobgpd); elevated memory usage or segmentation faults in the GoBGP daemon process.
• File System: Core dump files generated by a crashed GoBGP process, potentially containing memory contents from the time of exploitation.

The primary remediation is to upgrade GoBGP to version 4.4.0 or later, which includes the fix in commit 51ad1ada06cb41ce47b7066799981816f50b7ced (GoBGP Release). Ubuntu users should apply security notice USN-8348-1 when available. If immediate patching is not feasible, implement network segmentation to restrict BGP peer connectivity (TCP port 179) to only explicitly trusted and authorized BGP peers using firewall rules or BGP peer authentication (e.g., MD5 TCP session authentication). Monitoring BGP session logs for unexpected peer connections or parsing errors is also recommended as a detective control (Red Hat Bugzilla).

Red Hat opened a security tracking bug (Bugzilla #2464850) for this CVE, assigning it medium priority and severity, indicating it is being monitored for impact on Red Hat products (Red Hat Bugzilla). Ubuntu issued security notice USN-8348-1 addressing this and related GoBGP vulnerabilities. The vulnerability received standard automated coverage from vulnerability aggregators and CVE tracking feeds, with no notable independent researcher commentary or significant social media discussion identified.