CVE-2026-7734: GO-2026-5665 - GoBGP has an Improper Resource Shutdown or Release in github.com/osrg/gobgp

CVE-2026-7734 · Severity: medium · CVSS 5.3 · Published 2026-05-04

A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.

Technologies: github.com/osrg/gobgp/v4 (Go), Osrg Gobgp. Vendors: Go, Osrg.

Quick answers

Is CVE-2026-7734 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-7734 being exploited in the wild.
How severe is CVE-2026-7734?
Medium severity, with a CVSS score of 5.3, published 4 May 2026.
Which products and versions are affected?
github.com/osrg/gobgp/v4 (Go) SEMVER:introduced=0,fixed=4.4.0.
Is there a fix for CVE-2026-7734?
Yes. github.com/osrg/gobgp/v4 (Go): upgrade to 4.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2026-7734?
Check whether you run github.com/osrg/gobgp/v4 (Go) or Osrg Gobgp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/osrg/gobgp/v4 (Go): upgrade to 4.4.0 or later
    go get github.com/osrg/gobgp/v4@v4.4.0

Affected products

  • github.com/osrg/gobgp/v4 (Go) SEMVER:introduced=0,fixed=4.4.0
  • Osrg Gobgp

Identifiers

  • CVE-2026-7734
  • GHSA-vm3g-8xwv-mxfp
  • GO-2026-5665

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.