Integer Underflow in FRRouting Causes Denial of Service

Publication date: 2026-05-04

Last updated on: 2026-06-30

Assigner: MITRE

Description

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-04

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-05-05

EPSS Evaluated

2026-07-05

NVD

CVE-2026-37459

Affected Vendors & Products

Vendor	Product	Version / Range
frrouting	frr	From 10.0 (inc) to 10.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer underflow in FRRouting (FRR) versions stable/10.0 to stable/10.6. It occurs when an attacker supplies a specially crafted BGP UPDATE message, which triggers the underflow condition.

An integer underflow happens when an arithmetic operation attempts to create a numeric value that is lower than the minimum representable value, causing unexpected behavior in the software.

Impact Analysis

The impact of this vulnerability is a Denial of Service (DoS) condition. An attacker can exploit the integer underflow by sending a crafted BGP UPDATE message, causing the affected FRRouting software to crash or become unavailable.

This means network routing services relying on FRRouting could be disrupted, potentially affecting network availability.

Hi! I’m here to help you understand CVE-2026-37459. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70