Skip to main content

FRRouting CVE-2026-37459

| EUVDEUVD-2026-27047 HIGH
Uncontrolled Resource Consumption (CWE-400)
2026-05-04 mitre
Denial Of Service N A
7.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Source Code Evidence Fetched
May 04, 2026 - 20:22 vuln.today
Analysis Generated
May 04, 2026 - 20:22 vuln.today
CVSS changed
May 04, 2026 - 20:22 NVD
7.5 (HIGH)
CVE Published
May 04, 2026 - 00:00 nvd
N/A

DescriptionCVE.org

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

AnalysisAI

Denial of Service in FRRouting 10.0 through 10.6 allows remote unauthenticated attackers to crash the BGP daemon via a malformed BGP UPDATE message exploiting an integer underflow in next-hop capability processing. Upstream fix available in commit 693a2e0 but released patched version not independently confirmed. No public exploit identified at time of analysis, with EPSS score not provided suggesting low observed exploitation activity.

Technical ContextAI

FRRouting (FRR) is an open-source IP routing protocol suite supporting BGP, OSPF, IS-IS, and other protocols, commonly deployed in enterprise networks and internet service providers. The vulnerability resides in bgp_attr.c within the BGP attribute parser's next-hop capability (NHC) handler. An integer underflow occurs when processing TLV (Type-Length-Value) structures in BGP UPDATE messages: the code compares 'length < tlv_length' without accounting for the BGP_NHC_TLV_MIN_LEN constant, allowing a maliciously crafted TLV to pass validation with a manipulated length field. This underflow condition bypasses bounds checking, leading to out-of-bounds memory access during subsequent parsing operations. The root cause maps to CWE-400 (Uncontrolled Resource Consumption), though the immediate technical flaw is an integer underflow enabling memory corruption. BGP UPDATE messages are part of the BGP-4 protocol (RFC 4271) used for exchanging routing information between autonomous systems.

RemediationAI

Upstream fix available in GitHub commit 693a2e02687cdc9d16501275e05136edea9650d9; apply this patch to affected FRRouting 10.x installations or monitor vendor channels for tagged release incorporating the fix (https://github.com/FRRouting/frr/commit/693a2e02687cdc9d16501275e05136edea9650d9). If immediate patching is not feasible, implement BGP peering access controls by restricting TCP port 179 to trusted autonomous systems using firewall rules or routing policy, though this does not eliminate risk from compromised or malicious peers. For high-security environments, deploy BGP Route Validation (RFC 6811/8210) and RPKI to limit acceptance of malformed route advertisements, but note this addresses route hijacking rather than protocol-level DoS vulnerabilities. Monitor bgpd process health with automatic restart mechanisms to reduce sustained outage duration if exploitation occurs, but recognize this is a reactive control that does not prevent crashes. Disabling BGP entirely eliminates the attack surface but breaks routing functionality - only viable for non-production or lab environments. No side effects expected from the patch itself (adds single bounds check), but standard change control testing of BGP session stability and route convergence is recommended before production deployment.

More in N A

View all
CVE-2026-31072 CRITICAL POC
9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
CVE-2026-36356 CRITICAL POC
9.1 May 05

Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST
CVE-2026-31071 CRITICAL POC
9.1 May 19

Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al
CVE-2025-66391 HIGH POC
8.8 Jun 17

In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write o
CVE-2026-26740 HIGH POC
8.2 Mar 18

Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when

CVE-2025-60464 HIGH POC
7.8 Jun 25

Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_
CVE-2026-36355 HIGH POC
7.7 May 05

Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc
CVE-2025-60474 HIGH POC
7.5 Jun 24

Denial of service in GPAC's MP4Box/libgpac media importer (versions before 26.02.0) lets an attacker crash the tool by s
CVE-2026-38639 HIGH POC
7.5 Jun 26

An issue in the parse_month function (/time/strptime.rs) of relibc commit ab6a2e allows attackers to cause a Denial of S
CVE-2026-38641 HIGH POC
7.5 Jun 26

Denial of service in relibc (the Redox OS C standard library) at commit 61f42d allows attackers to crash a process by ge
CVE-2026-38637 HIGH POC
7.5 Jun 25

An issue in the pthread_rwlockattr_setpshared() function of relibc commit 61f42d allows attackers to cause a Denial of S
CVE-2026-38640 HIGH POC
7.5 Jun 25

Denial of service in relibc (the Redox OS C standard library implementation, commit 61f42d) lets attackers crash a proce

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all
CVE-2023-44487 HIGH POC
7.5
CVE-2016-8610 HIGH
7.5
CVE-2026-28318 HIGH POC
7.5
CVE-2026-45498 MEDIUM POC
4.0
CVE-2025-26673 HIGH
7.5
CVE-2015-7978 HIGH
7.5
CVE-2025-27473 HIGH
7.5
CVE-2025-27469 HIGH
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Server Applications 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

CVE-2026-37459 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy