{"id":"EUVD-2026-26917","enisaUuid":"3b3c5f7b-d867-3265-a780-9e1bb5d5ffd5","description":"A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.","datePublished":"May 4, 2026, 5:45:12 AM","dateUpdated":"May 5, 2026, 12:57:22 AM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","references":"https://vuldb.com/vuln/360912\nhttps://vuldb.com/vuln/360912/cti\nhttps://vuldb.com/submit/807605\nhttps://github.com/osrg/gobgp/commit/bc77597d42335c78464bc8e15a471d887bbdf260\nhttps://github.com/osrg/gobgp/releases/tag/v4.4.0\nhttps://github.com/osrg/gobgp/\n","aliases":"CVE-2026-7737\n","assigner":"VulDB","epss":0.63,"enisaIdProduct":[{"id":"4da797ad-5c10-3f2a-81b2-692ef75b1c61","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"4.0"},{"id":"762155a6-ff7c-3bcb-ae2d-a561eaca2bda","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"4.3.0"},{"id":"91d668f0-191d-31ff-86ef-1b902dc6d42e","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"4.1"},{"id":"fd1cabea-566f-38aa-b0aa-1458cb0de70a","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"4.2"}],"enisaIdVendor":[{"id":"6d6a713d-cd3b-3976-83e5-71ac9282663b","vendor":{"name":"osrg"}}],"enisaIdVulnerability":[{"id":"3f30c1bd-6aa6-37a9-9f7e-e5ea3c604cdf","vulnerability":{"id":"GHSA-w88c-9vg8-cmq8","description":"GoBGP has Improper Restriction of Operations within the Bounds of a Memory Buffer","datePublished":"May 4, 2026, 9:31:09 AM","dateUpdated":"May 11, 2026, 4:11:47 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-7737\nhttps://github.com/osrg/gobgp/commit/bc77597d42335c78464bc8e15a471d887bbdf260\nhttps://github.com/osrg/gobgp\nhttps://github.com/osrg/gobgp/releases/tag/v4.4.0\nhttps://vuldb.com/submit/807605\nhttps://vuldb.com/vuln/360912\nhttps://vuldb.com/vuln/360912/cti\n","enisa_id":"EUVD-2026-26917\n","aliases":"CVE-2026-7737\nGHSA-w88c-9vg8-cmq8\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:50 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"745bafbe-6be7-3d83-83f9-a21f353495c3","vulnerability":{"id":"CVE-2026-7737","description":"A vulnerability was identified in osrg GoBGP up to 4.3.0. Affected by this issue is the function BMPPeerUpNotification.ParseBody/BMPStatisticsReport.ParseBody of the file pkg/packet/bmp/bmp.go of the component BMP Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. Upgrading to version 4.4.0 can resolve this issue. The identifier of the patch is bc77597d42335c78464bc8e15a471d887bbdf260. Upgrading the affected component is recommended.","datePublished":"May 4, 2026, 5:45:12 AM","dateUpdated":"May 5, 2026, 12:57:22 AM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X","references":"https://vuldb.com/vuln/360912\nhttps://vuldb.com/vuln/360912/cti\nhttps://vuldb.com/submit/807605\nhttps://github.com/osrg/gobgp/commit/bc77597d42335c78464bc8e15a471d887bbdf260\nhttps://github.com/osrg/gobgp/releases/tag/v4.4.0\nhttps://github.com/osrg/gobgp/\n","enisa_id":"EUVD-2026-26917\n","assigner":"VulDB","epss":0.63,"dataProcessed":"Oct 28, 2026, 7:17:27 AM","vulnerabilityProduct":[{"id":"17f288a7-8420-3888-a4d1-b2cc85265e8b","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"4.2"},{"id":"1d83710c-8a9e-36e7-8462-9c9018552d4e","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"4.0"},{"id":"4b2012e5-0ba9-323a-aa40-e9ab030283e2","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"4.1"},{"id":"88be702e-a7b9-3e1d-b197-461908169e55","product":{"name":"GoBGP","vendor":{"name":"osrg"}},"product_version":"4.3.0"}],"vulnerabilityVendor":[{"id":"a4b86d2c-5683-39b2-b24a-d783e75d3de0","vendor":{"name":"osrg"}}]}}],"enisaIdAdvisory":[]}