CVE-2026-37460
Heap-based Buffer Overflow in FRRouting BGP UPDATE Processing
Publication date: 2026-06-03
Last updated on: 2026-06-05
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| frrouting | frr | From 10.0 (inc) to 10.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is caused by missing input validation in the rfapiRibBi2Ri() function within the rfapi_rib.c file of FRRouting (FRR) versions stable/10.0 to stable/10.6.
An attacker can exploit this flaw by sending a specially crafted BGP UPDATE message, which triggers the vulnerability.
The result of this exploitation is a Denial of Service (DoS), meaning the targeted FRRouting service can be disrupted or made unavailable.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a Denial of Service (DoS) condition on systems running affected versions of FRRouting.
This means that an attacker could cause the FRRouting service to crash or become unresponsive by sending a crafted BGP UPDATE message.
Such disruption can affect network routing stability and availability, potentially leading to network outages or degraded network performance.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.