CVE-2026-37459
Deferred Deferred - Pending Action
Integer Underflow in FRRouting Causes Denial of Service

Publication date: 2026-05-04

Last updated on: 2026-05-04

Assigner: MITRE

Description
An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-04
Last Modified
2026-05-04
Generated
2026-06-16
AI Q&A
2026-05-05
EPSS Evaluated
2026-06-15
NVD
CVE-2026-37459
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
frrouting frr From 10.0 (inc) to 10.6 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an integer underflow in FRRouting (FRR) versions stable/10.0 to stable/10.6. It occurs when an attacker supplies a specially crafted BGP UPDATE message, which triggers the underflow condition.

An integer underflow happens when an arithmetic operation attempts to create a numeric value that is lower than the minimum representable value, causing unexpected behavior in the software.

Impact Analysis

The impact of this vulnerability is a Denial of Service (DoS) condition. An attacker can exploit the integer underflow by sending a crafted BGP UPDATE message, causing the affected FRRouting software to crash or become unavailable.

This means network routing services relying on FRRouting could be disrupted, potentially affecting network availability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-37459. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart