Skip to main content

FRRouting CVE-2026-37459

| EUVDEUVD-2026-27047 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-05-04 mitre
Denial Of Service N A
7.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Source Code Evidence Fetched
May 04, 2026 - 20:22 vuln.today
Analysis Generated
May 04, 2026 - 20:22 vuln.today
CVSS changed
May 04, 2026 - 20:22 NVD
7.5 (HIGH)
CVE Published
May 04, 2026 - 00:00 nvd
N/A

DescriptionCVE.org

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

AnalysisAI

Denial of Service in FRRouting 10.0 through 10.6 allows remote unauthenticated attackers to crash the BGP daemon via a malformed BGP UPDATE message exploiting an integer underflow in next-hop capability processing. Upstream fix available in commit 693a2e0 but released patched version not independently confirmed. No public exploit identified at time of analysis, with EPSS score not provided suggesting low observed exploitation activity.

Technical ContextAI

FRRouting (FRR) is an open-source IP routing protocol suite supporting BGP, OSPF, IS-IS, and other protocols, commonly deployed in enterprise networks and internet service providers. The vulnerability resides in bgp_attr.c within the BGP attribute parser's next-hop capability (NHC) handler. An integer underflow occurs when processing TLV (Type-Length-Value) structures in BGP UPDATE messages: the code compares 'length < tlv_length' without accounting for the BGP_NHC_TLV_MIN_LEN constant, allowing a maliciously crafted TLV to pass validation with a manipulated length field. This underflow condition bypasses bounds checking, leading to out-of-bounds memory access during subsequent parsing operations. The root cause maps to CWE-400 (Uncontrolled Resource Consumption), though the immediate technical flaw is an integer underflow enabling memory corruption. BGP UPDATE messages are part of the BGP-4 protocol (RFC 4271) used for exchanging routing information between autonomous systems.

RemediationAI

Upstream fix available in GitHub commit 693a2e02687cdc9d16501275e05136edea9650d9; apply this patch to affected FRRouting 10.x installations or monitor vendor channels for tagged release incorporating the fix (https://github.com/FRRouting/frr/commit/693a2e02687cdc9d16501275e05136edea9650d9). If immediate patching is not feasible, implement BGP peering access controls by restricting TCP port 179 to trusted autonomous systems using firewall rules or routing policy, though this does not eliminate risk from compromised or malicious peers. For high-security environments, deploy BGP Route Validation (RFC 6811/8210) and RPKI to limit acceptance of malformed route advertisements, but note this addresses route hijacking rather than protocol-level DoS vulnerabilities. Monitor bgpd process health with automatic restart mechanisms to reduce sustained outage duration if exploitation occurs, but recognize this is a reactive control that does not prevent crashes. Disabling BGP entirely eliminates the attack surface but breaks routing functionality - only viable for non-production or lab environments. No side effects expected from the patch itself (adds single bounds check), but standard change control testing of BGP session stability and route convergence is recommended before production deployment.

More in N A

View all
CVE-2024-51092 CRITICAL POC
9.1 May 08

LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
CVE-2025-15684 MEDIUM POC
5.5 Aug 12

Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
CVE-2024-45257 HIGH POC
7.3 May 08

A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
CVE-2025-15687 LOW POC
2.1 Aug 12

Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
CVE-2025-15686 LOW POC
2.1 Aug 12

Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
CVE-2025-67888 HIGH POC
7.3 May 08

Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root

CVE-2024-53326 HIGH POC
7.3 May 08

LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
CVE-2026-38360 CRITICAL POC
9.8 May 08

Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
CVE-2026-30623 CRITICAL POC
9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
CVE-2026-67917 CRITICAL POC
9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
CVE-2026-75337 CRITICAL POC
9.8 Aug 27

Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2026-45498 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2023-38180 HIGH
7.5
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2026-37459 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy