Skip to main content

FRRouting (FRR) CVE-2026-37458

| EUVDEUVD-2026-26977 MEDIUM
Improper Input Validation (CWE-20)
2026-05-04 mitre
Denial Of Service Red Hat N A Suse
6.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SUSE
MEDIUM
qualitative
Red Hat
6.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Source Code Evidence Fetched
May 05, 2026 - 16:22 vuln.today
Analysis Generated
May 05, 2026 - 16:22 vuln.today
CVSS changed
May 05, 2026 - 16:22 NVD
6.5 (MEDIUM)
EUVD ID Assigned
May 04, 2026 - 16:00 euvd
EUVD-2026-26977
CVE Published
May 04, 2026 - 00:00 nvd
N/A

DescriptionCVE.org

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

AnalysisAI

Missing input validation in FRRouting stable/10.0 through 10.6 allows authenticated BGP peers to trigger a Denial of Service by sending a crafted UPDATE message with invalid martian addresses in the MP_REACH_NLRI component. An authenticated attacker can crash or severely degrade the BGP routing daemon by exploiting insufficient validation of next-hop addresses, with an EPSS score of 0.02% indicating low real-world exploitation probability despite moderate CVSS scoring.

Technical ContextAI

FRRouting is an open-source IP routing protocol suite. The vulnerability exists in the BGP (Border Gateway Protocol) attribute parser, specifically in the MP_REACH_NLRI (Multiprotocol Reachable NLRI) handling code within bgpd/bgp_attr.c. The MP_REACH_NLRI is a BGP UPDATE message component used to advertise reachable network layer reachability information in multiprotocol extensions. The root cause is CWE-20 (Improper Input Validation) - the parser fails to validate whether the next-hop address is a martian address (reserved, bogus, or otherwise invalid for routing). The fix adds a check using ipv4_martian() to detect invalid addresses and withdraw the route when a martian nexthop is encountered, mirroring validation already applied to the NEXT_HOP attribute. This is a logic flaw in protocol parsing that allows a malformed but syntactically valid BGP message to reach unsafe downstream processing.

RemediationAI

Upgrade FRRouting to a version after stable/10.6 or apply the upstream commit 8102a8aeceb9f86fdfe1f80cd77080522bab69c8 directly to your installation. The patch adds validation of next-hop addresses in the MP_REACH_NLRI parser to reject martian (reserved) IPv4 addresses unless explicitly allowed via the bgp allow-martian configuration directive. For operators unable to patch immediately, implement compensating controls: restrict BGP peers to trusted route originator networks only, enforce strict ingress route filtering (IRR-based prefix lists) to block advertisements from unauthorized ASNs, and configure BGP route dampening to limit the impact of rapid route withdrawals. Monitor BGP route updates for unexpected martian addresses using syslog inspection (look for 'sent martian nexthop' warnings) and alert on BGP session flaps. These controls reduce but do not eliminate the risk; patching is strongly preferred.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-20 – Improper Input Validation

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2024-3400 CRITICAL POC
10.0
CVE-2022-47966 CRITICAL POC
9.8
CVE-2023-22515 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2017-9791 CRITICAL POC
9.8
CVE-2017-15944 CRITICAL POC
9.8
CVE-2019-0604 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2026-37458 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy