CVE-2026-37460
Heap-based Buffer Overflow in FRRouting BGP UPDATE Processing
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| frrouting | frr | From 10.0 (inc) to 10.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is caused by missing input validation in the rfapiRibBi2Ri() function within the rfapi_rib.c file of FRRouting (FRR) versions stable/10.0 to stable/10.6.
An attacker can exploit this flaw by sending a specially crafted BGP UPDATE message, which triggers the vulnerability.
The result of this exploitation is a Denial of Service (DoS), meaning the targeted FRRouting service can be disrupted or made unavailable.
How can this vulnerability impact me? :
The primary impact of this vulnerability is a Denial of Service (DoS) condition on systems running affected versions of FRRouting.
This means that an attacker could cause the FRRouting service to crash or become unresponsive by sending a crafted BGP UPDATE message.
Such disruption can affect network routing stability and availability, potentially leading to network outages or degraded network performance.