5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-7737

CVE-2026-7737: GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-7737

CVE-2026-7737:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/osrg/gobgp	go	< 4.4.0	4.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the BMP parser of GoBGP, specifically within the ParseBody methods for BMPStatisticsReport and BMPPeerUpNotification. The patch bc77597d42335c78464bc8e15a471d887bbdf260 reveals that these functions were reading from a byte slice (data) without first validating its length. For BMPStatisticsReport.ParseBody, the code read 4 bytes to get a count, and for BMPPeerUpNotification.ParseBody, it could read up to 16 bytes for an IP address. An attacker could send a crafted, short BMP message, causing the application to read beyond the bounds of the provided buffer. This leads to an out-of-bounds read, which could cause a panic and denial of service. The fix involves adding length checks at the beginning of both functions to ensure the data slice is large enough for the subsequent read operations, thus preventing the out-of-bounds access.

Vulnerable functions

BMPStatisticsReport.ParseBody

pkg/packet/bmp/bmp.go

The function reads 4 bytes from the 'data' slice to determine the count of statistics without first checking if the slice has enough data. This can lead to an out-of-bounds read if a malicious or malformed BMP message is received.

BMPPeerUpNotification.ParseBody

pkg/packet/bmp/bmp.go

The function reads up to 16 bytes from the 'data' slice for the local address without first verifying the slice's length. A check for a minimum length of 20 bytes was added to prevent a potential out-of-bounds read when processing BMP Peer Up Notifications.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.