A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8348-1 advisory.

    It was discovered that GoBGP incorrectly handled certain specially crafted BGP UPDATE messages. A remote     attacker could possibly use this issue to cause GoBGP to crash, resulting in a denial of service.
    (CVE-2026-37461)

    Yanlei Wang discovered that GoBGP incorrectly handled certain malformed BGP UPDATE messages containing     4-byte AS attributes. A remote attacker could possibly use this issue to cause GoBGP to crash, resulting     in a denial of service. (CVE-2026-41643)

    It was discovered that GoBGP incorrectly handled certain malformed BGP UPDATE messages containing SRv6 L3     Service attributes. A remote attacker could possibly use this issue to cause GoBGP to crash, resulting in     a denial of service. (CVE-2026-7734)

    It was discovered that GoBGP incorrectly handled certain malformed BGP UPDATE messages containing     Accumulated IGP (AIGP) attributes. A remote attacker could possibly use this issue to cause GoBGP to     crash, resulting in a denial of service. (CVE-2026-7735)

    It was discovered that GoBGP incorrectly handled certain malformed Multi- threaded Routing Toolkit (MRT)     routing information entries. A remote attacker could possibly use this issue to cause GoBGP to crash,     resulting in a denial of service. (CVE-2026-7736)

    It was discovered that GoBGP incorrectly handled certain malformed Multi- threaded Routing Toolkit (MRT)     headers. A remote attacker could possibly use this issue to cause GoBGP to crash, resulting in a denial of     service. (CVE-2026-7737)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function     PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute     Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack     remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named     51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded. (CVE-2026-7735)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
318621	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : GoBGP vulnerabilities (USN-8348-1)	Nessus	Ubuntu Local Security Checks	Local	medium
312045	Linux Distros Unpatched Vulnerability : CVE-2026-7735	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-7735

medium

Tenable Plugins

medium

medium