CVE-2026-7736: osrg gobgp Numeric Errors
Vulnerability summary
CVE-2026-7736 is a high (CVSS 7.5) Numeric Errors vulnerability in osrg gobgp. EPSS estimates a 0.63% chance of exploitation in the next 30 days, higher than 49.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 04-05-2026PublishedVulnerability first disclosed.
- 04-05-2026Last modifiedVulnerability information updated.
Description
A vulnerability was determined in osrg GoBGP up to 4.3.0. Affected by this vulnerability is the function parseRibEntry of the file pkg/packet/mrt/mrt.go. Executing a manipulation can lead to integer underflow. It is possible to launch the attack remotely. Upgrading to version 4.4.0 addresses this issue. This patch is called 76d911046344a3923cbe573364197aa081944592. It is suggested to upgrade the affected component.
CVSS metrics
12 scores · 5 sources · 4 versions- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- OSV · GoEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- OSV · GoEcosystem advisory · calculated7.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
- NVDNIST7.5HighAV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS trend
Probability
0.63%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
+0.17 pp
From 0.45% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-189Numeric ErrorsWeaknesses in this category are related to improper calculation or conversion of numbers.
- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Affected systems
Debian1 product
- gobgpAll versions (No fix recorded) | < 4.4.0-1
Github.com/osrg/gobgp1 product
- v4< 4.4.0
Osrg1 product
- gobgp4.0 | 4.1 | 4.2 | 4.3.0 | < 4.4.0
Ubuntu1 product
- gobgp< 1.29-1ubuntu0.1+esm2 | < 2.12.0-1ubuntu0.1~esm3 | < 2.25.0-3ubuntu0.1+esm4 | < 3.23.0-1ubuntu0.3+esm4 | All versions (No fix recorded) | < 3.36.0-2ubuntu0.1~esm1
4 vendors · 4 products
References
13 links- github.com/osrg/gobgp/Product
Show all 13 references
- github.com/osrg/gobgpPACKAGE