VYPR
Get started
← All advisories
Medium severity5.3NVD Advisory· Published May 4, 2026· Updated May 6, 2026

CVE-2026-7734

CVE-2026-7734

Description

A vulnerability has been found in osrg GoBGP up to 4.3.0. This impacts the function SRv6L3ServiceAttribute.DecodeFromBytes of the file pkg/packet/bgp/prefix_sid.go of the component SRv6 L3 Service. Such manipulation of the argument data leads to denial of service. The attack may be performed from remote. Upgrading to version 4.4.0 will fix this issue. The name of the patch is f9f7b55ec258e514be0264871fa645a2c3edad11. You should upgrade the affected component.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/osrg/gobgp/v4Go
< 4.4.04.4.0

Affected products

2
  • Osrg/Gobgpinferred2 versions
    <=4.3.0+ 1 more
    • (no CPE)range: <=4.3.0
    • cpe:2.3:a:osrg:gobgp:*:*:*:*:*:*:*:*range: <4.4.0

Patches

1
f9f7b55ec258

packet/bgp: fix infinite loop when decoding srv6 unknown sub-TLV types

https://github.com/osrg/gobgpFUJITA TomonoriApr 1, 2026via ghsa
commit
2 files changed · +37 −4
  • pkg/packet/bgp/prefix_sid.go+4 −4 modified
    @@ -228,10 +228,10 @@ func (s *SRv6L3ServiceAttribute) DecodeFromBytes(data []byte) error {
 				SubSubTLVs: make([]PrefixSIDTLVInterface, 0),
 			}
 		default:
-			if len(data) < t.Len() {
+			if len(stlvs) < t.Len() {
 				return malformedAttrListErr("SRv6L3ServiceAttribute/SubTLV malformed")
 			}
-			data = data[t.Len():]
+			stlvs = stlvs[t.Len():]
 			continue
 		}
 
@@ -674,10 +674,10 @@ func (s *SRv6ServiceTLV) DecodeFromBytes(data []byte) error {
 				SubSubTLVs: make([]PrefixSIDTLVInterface, 0),
 			}
 		default:
-			if len(data) < t.Len() {
+			if len(stlvs) < t.Len() {
 				return malformedAttrListErr("SRv6ServiceTLV malformed")
 			}
-			data = data[t.Len():]
+			stlvs = stlvs[t.Len():]
 			continue
 		}
  • pkg/packet/bgp/prefix_sid_test.go+33 −0 modified
    @@ -128,6 +128,39 @@ func TestNewPathAttributePrefixSID(t *testing.T) {
 	}
 }
 
+func TestSRv6L3ServiceUnknownSubTLV(t *testing.T) {
+	// SRv6L3ServiceAttribute with an unknown sub-TLV type (0xff).
+	// Previously, the default branch advanced the wrong variable (data
+	// instead of stlvs), causing an infinite loop.
+	input := []byte{
+		0x05,       // Type: TLVTypeSRv6L3Service
+		0x00, 0x07, // Length: 7 (1 reserved + 6 sub-TLV)
+		0x00, // Reserved
+		// Unknown sub-TLV: Type=0xff, Length=3, Value=0x01,0x02,0x03
+		0xff, 0x00, 0x03, 0x01, 0x02, 0x03,
+	}
+	s := &SRv6L3ServiceAttribute{}
+	err := s.DecodeFromBytes(input)
+	assert.NoError(t, err)
+	assert.Equal(t, 0, len(s.SubTLVs))
+}
+
+func TestSRv6ServiceTLVUnknownSubTLV(t *testing.T) {
+	// SRv6ServiceTLV with an unknown sub-TLV type (0xff).
+	// Same bug as SRv6L3ServiceAttribute.
+	input := []byte{
+		0x05,       // Type: TLVTypeSRv6L3Service
+		0x00, 0x07, // Length: 7 (1 reserved + 6 sub-TLV)
+		0x00, // Reserved
+		// Unknown sub-TLV: Type=0xff, Length=3, Value=0x01,0x02,0x03
+		0xff, 0x00, 0x03, 0x01, 0x02, 0x03,
+	}
+	s := &SRv6ServiceTLV{}
+	err := s.DecodeFromBytes(input)
+	assert.NoError(t, err)
+	assert.Equal(t, 0, len(s.SubTLVs))
+}
+
 // to make label with bottom of stack
 type prefixSidLabel struct {
 	Label uint32

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

7

News mentions

0

No linked articles in our index yet.