A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the compone…

A buffer overflow vulnerability (CVE-2026-7735) was discovered in osrg GoBGP versions up to 4.3.0. The vulnerability affects the PathAttributeAigp.DecodeFromBytes function in the AIGP Attribute Parser component. An attacker can remotely exploit this vulnerability by manipulating BGP packets, potentially leading to system compromise. The vulnerability is located in the pkg/packet/bgp/bgp.go file and can be triggered through remote attacks. A patch is available in version 4.4.0 with commit 51ad1ada06cb41ce47b7066799981816f50b7ced. Organizations using affected versions should upgrade immediately to mitigate this security risk.