CVE-2026-119776
Received Received - Intake

OSPFv3 Packet Validation Flaw in FRRouting

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: 57a55968-44ac-464c-a794-6ba3baad09c4

Description
In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks. Note the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-119776
EUVD
EUVD-2026-116915

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
frrouting frrouting 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-304 The product implements an authentication technique, but it skips a step that weakens the technique.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FRRouting's OSPFv3 implementation allows attackers to send OSPFv3 Hello packets with global IPv6 source addresses instead of required link-local addresses. The daemon fails to validate the source address, enabling malicious actors to establish OSPFv3 adjacencies from distant hosts. While OSPFv3 authentication trailers can mitigate full exploitation, they do not prevent CPU waste from processing spoofed packets.

Detection Guidance

Monitor ospf6d logs for OSPFv3 Hello packets with non-link-local source addresses. Use tcpdump to capture OSPFv3 traffic and filter for global IPv6 sources: tcpdump -i any -n 'ip6 and proto 89 and not src fe80::/10'. Check FRR logs for rejected adjacency attempts or unexpected neighbor relationships.

Impact Analysis

An attacker could disrupt routing operations by manipulating OSPFv3 neighbor relationships, resetting legitimate adjacencies, or causing database exchanges that consume CPU resources. This may lead to network instability or denial-of-service conditions if exploited repeatedly.

Mitigation Strategies

Upgrade FRRouting to a patched version implementing proper link-local address validation. Enable OSPFv3 authentication trailers (RFC 7166) to mitigate exploitation. Block OSPFv3 traffic from non-link-local sources at network borders. Monitor logs for repeated failed adjacency attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...