GoBGP (<= 4.3.0) — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/gobgp--4.3.0/Trending threats, MITRE ATT&CK coverage, and detection metadata — refreshed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 04 May 2026 07:16:01 +0000osrg GoBGP Integer Underflow Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-05-gobgp-integer-underflow/Mon, 04 May 2026 07:16:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-gobgp-integer-underflow/osrg GoBGP up to version 4.3.0 is vulnerable to an integer underflow in the parseRibEntry function, potentially allowing a remote attacker to cause a denial of service or other unspecified impacts; version 4.4.0 addresses this issue.A vulnerability exists in osrg GoBGP, specifically in versions up to 4.3.0. The flaw is located within the parseRibEntry function of the pkg/packet/mrt/mrt.go file. This integer underflow vulnerability, identified as CVE-2026-7736, can be triggered remotely by an attacker who sends malicious or unexpected data to the affected function. Successful exploitation could lead to a denial-of-service condition or other unspecified consequences. Users are advised to upgrade to version 4.4.0, which contains the patch identified as 76d911046344a3923cbe573364197aa081944592, to mitigate the risk. The vulnerability poses a risk to network infrastructure relying on the BGP protocol, potentially impacting routing stability and availability.

Attack Chain

  1. An attacker identifies a vulnerable GoBGP instance running a version prior to 4.4.0.
  2. The attacker crafts a malicious MRT (Multi-Threaded Routing Toolkit) message.
  3. The attacker sends the crafted MRT message to the vulnerable GoBGP instance. This is typically done over a TCP connection to the BGP port (179).
  4. The parseRibEntry function processes the malicious MRT message.
  5. Due to the integer underflow vulnerability, the parseRibEntry function calculates an incorrect value.
  6. This incorrect value leads to unexpected behavior such as a crash or resource exhaustion.
  7. The GoBGP process becomes unstable or terminates.
  8. This disrupts BGP routing, potentially leading to a denial-of-service condition for network services that rely on BGP.

Impact

Successful exploitation of this vulnerability could allow a remote attacker to disrupt BGP routing, leading to a denial-of-service condition. The precise impact will depend on the specific network configuration and the role of the affected GoBGP instance. Systems relying on the BGP protocol for routing information could experience connectivity issues or routing instability. While the number of affected deployments is unknown, any organization utilizing GoBGP in their network infrastructure is potentially at risk.

Recommendation

  • Upgrade to GoBGP version 4.4.0 or later to remediate the integer underflow vulnerability described in CVE-2026-7736.
  • Monitor network traffic for unexpected MRT messages being sent to GoBGP instances using the Sigma rule provided below.
  • Review and harden BGP configurations to limit exposure and potential attack surface.
]]>mediumadvisorycvevulnerabilityinteger underflowbgpGoBGP AIGP Attribute Parser Buffer Overflow Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-05-gobgp-buffer-overflow/Mon, 04 May 2026 06:16:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-gobgp-buffer-overflow/A remote buffer overflow vulnerability exists in osrg GoBGP up to version 4.3.0 within the PathAttributeAigp.DecodeFromBytes function, allowing attackers to potentially execute arbitrary code by manipulating the AIGP Attribute Parser.A buffer overflow vulnerability has been identified in the osrg GoBGP software, specifically affecting versions up to 4.3.0. The vulnerability resides in the PathAttributeAigp.DecodeFromBytes function of the pkg/packet/bgp/bgp.go file, which is part of the AIGP Attribute Parser component. An attacker can remotely trigger this vulnerability by sending a crafted BGP message containing a malicious AIGP attribute. Successful exploitation could lead to arbitrary code execution on the affected system. GoBGP is an open source BGP implementation. Organizations using GoBGP for routing purposes should upgrade to version 4.4.0 or apply the provided patch (51ad1ada06cb41ce47b7066799981816f50b7ced) to mitigate this risk.

Attack Chain

  1. Attacker identifies a GoBGP instance running a vulnerable version (<= 4.3.0).
  2. Attacker crafts a malicious BGP update message containing a specially crafted AIGP attribute.
  3. The crafted AIGP attribute is designed to trigger a buffer overflow in the PathAttributeAigp.DecodeFromBytes function.
  4. The attacker sends the malicious BGP update message to the vulnerable GoBGP instance over TCP port 179.
  5. The GoBGP instance receives the message and attempts to parse the AIGP attribute using the vulnerable function.
  6. The PathAttributeAigp.DecodeFromBytes function fails to properly validate the size of the input data, leading to a buffer overflow.
  7. The buffer overflow overwrites adjacent memory regions, potentially including critical program data or executable code.
  8. The attacker leverages the memory corruption to execute arbitrary code on the GoBGP instance, gaining control of the system.

Impact

Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code on the affected GoBGP instance. This can lead to a complete compromise of the routing infrastructure, allowing the attacker to intercept, modify, or disrupt network traffic. In service provider environments, this could affect a large number of customers and cause significant network outages. Given the CVSS v3.1 score of 7.3, this is considered a high-severity vulnerability.

Recommendation

  • Upgrade to GoBGP version 4.4.0 to remediate the vulnerability as mentioned in the overview.
  • Apply the patch 51ad1ada06cb41ce47b7066799981816f50b7ced to the affected component to mitigate the vulnerability if upgrading is not immediately possible.
  • Monitor network traffic for BGP update messages with unusually large or malformed AIGP attributes, using a network intrusion detection system.
  • Deploy the Sigma rule detecting connections to port 179 from unusual sources to identify potentially malicious hosts attempting to exploit the vulnerability.
  • Review and harden BGP configuration to limit accepted peer connections to trusted sources only.
]]>highadvisorycve-2026-7735buffer-overflowbgp