# CVE-2026-7734: GO-2026-5665 - GoBGP has an Improper Resource Shutdown or Release in github.com/osrg/gobgp

Source: https://junglewise.ai/threats/cve-2026-7734-gobgp-has-an-improper-resource-shutdown-or-release  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04  
License: CC BY 4.0 with a link back

CVE-2026-7734 · Severity: medium · CVSS 5.3 · Published 2026-05-04

A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.

Technologies: [github.com/osrg/gobgp/v4 (Go)](https://junglewise.ai/threats/technologies/github-com-osrg-gobgp-v4), [Osrg Gobgp](https://junglewise.ai/threats/technologies/gobgp). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Osrg](https://junglewise.ai/threats/vendors/osrg).

## Quick answers

**Is CVE-2026-7734 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-7734 being exploited in the wild.

**How severe is CVE-2026-7734?** Medium severity, with a CVSS score of 5.3, published 4 May 2026.

**Which products and versions are affected?** github.com/osrg/gobgp/v4 (Go) SEMVER:introduced=0,fixed=4.4.0.

**Is there a fix for CVE-2026-7734?** Yes. github.com/osrg/gobgp/v4 (Go): upgrade to 4.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-7734?** Check whether you run github.com/osrg/gobgp/v4 (Go) or Osrg Gobgp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/osrg/gobgp/v4 (Go): upgrade to 4.4.0 or later

  ```sh
  go get github.com/osrg/gobgp/v4@v4.4.0
  ```


## Affected products

- github.com/osrg/gobgp/v4 (Go) SEMVER:introduced=0,fixed=4.4.0
- Osrg Gobgp

## Identifiers

- CVE-2026-7734
- GHSA-vm3g-8xwv-mxfp
- GO-2026-5665

## Related threats

- [osrg GoBGP denial of service via empty AS_PATH attribute](https://junglewise.ai/threats/cve-2026-49838-osrg-gobgp-denial-of-service-via-empty-as-path-attribute)
- [GoBGP out-of-bounds read in BGP OPEN capability parser](https://junglewise.ai/threats/cve-2026-49837-gobgp-out-of-bounds-read-in-bgp-open-capability-parser)
- [GoBGP integer underflow in BGPUpdate.DecodeFromBytes](https://junglewise.ai/threats/cve-2026-37462-gobgp-integer-underflow-in-bgpupdate-decodefrombytes)
- [osrg GoBGP nil pointer dereference in AdjRib.Update](https://junglewise.ai/threats/cve-2026-42285-osrg-gobgp-nil-pointer-dereference-in-adjrib-update)
- [GoBGP has Remote Denial of Service (Panic) in UpdatePathAttrs4ByteAs via Malformed BGP UPDATE](https://junglewise.ai/threats/cve-2026-41643-gobgp-has-remote-denial-of-service-panic-in)