Every CVE Search/ Get API key

CVE-2026-28532

FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions

6.0 MediumFix available

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Attack profile

How easy it is to exploit

Attack vector
Adjacent network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.22%Up 0.2 points since May 1, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.0

FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Record
CVE-2026-28532
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-190, CWE-125
Updated
2026-11-02
EUVDEUVD-2026-26418 6.0

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Record
EUVD-2026-26418
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-wjc3-2qjv-c8fp 6.0

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic...

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Record
GHSA-wjc3-2qjv-c8fp
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
NVD 6.0

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Record
CVE-2026-28532
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125, CWE-190
Updated
2026-11-02
OSV 6.0

FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Record
CVE-2026-28532
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-125, CWE-190
Updated
2026-11-02
OSVDEBIAN-CVE-2026-28532 6.0

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Record
DEBIAN-CVE-2026-28532
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 10 moreShow less
OSVUBUNTU-CVE-2026-28532 6.0

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Record
UBUNTU-CVE-2026-28532
CVSS 4.0
6.0 MediumCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSVAZL-85332 No score

CVE-2026-28532 affecting package frr for versions less than 10.5.0-3

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Record
AZL-85332
Updated
2026-11-05
OSVopenSUSE-SU-2026:10721-1 No score

frr-10.6.1-1.1 on GA media

These are all security issues fixed in the frr-10.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10721-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20898-1 No score

Security update for frr

This update for frr fixes the following issues:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
openSUSE-SU-2026:20898-1
Updated
2026-11-02
OSVSUSE-SU-2026:22026-1 No score

Security update for frr

This update for frr fixes the following issues:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
SUSE-SU-2026:22026-1
Updated
2026-11-02
OSVSUSE-SU-2026:2454-1 No score

Security update for frr

This update for frr fixes the following issues

Update to frr 8.5.7:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974). DoS via a crafted UPDATE message (bsc#1263974).
Record
SUSE-SU-2026:2454-1
Updated
2026-11-02
OSVSUSE-SU-2026:2455-1 No score

Security update for frr

This update for frr fixes the following issues

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
SUSE-SU-2026:2455-1
Updated
2026-11-02
OSVSUSE-SU-2026:2457-1 No score

Security update for frr

This update for frr fixes the following issue:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
SUSE-SU-2026:2457-1
Updated
2026-11-02
OSVSUSE-SU-2026:2644-1 No score

Security update for frr

This update for frr fixes the following issues

  • CVE-2026-28532: Denial of Service due to integer overflow in OSPF TLV parser functions (bsc#1263859).
  • CVE-2026-37457: An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (bsc#1263863).
  • CVE-2026-37458: missing input validation in the MP_REACH_NLRI component allows authenticated attackers to cause a DoS via a crafted UPDATE message (bsc#1263974).
Record
SUSE-SU-2026:2644-1
Updated
2026-11-02
OSVUSN-8376-1 No score

frr vulnerabilities

It was discovered that FRR incorrectly handled certain OSPF Traffic Engineering and Segment Routing TLVs. An attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2026-28532)

It was discovered that FRR incorrectly handled certain BGP FlowSpec components. An attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2026-37457)

It was discovered that FRR did not properly validate certain MP_REACH_NLRI messages. An authenticated user could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2026-37458)

It was discovered that FRR incorrectly handled processing certain BGP UPDATE messages. An attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. This issue only affected Ubuntu 25.04 and Ubuntu 25.10. (CVE-2026-37459)

Record
USN-8376-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
frr
Azure Linux:3
 before 10.5.0-3
10.5.0-3
frr
Debian:12
 before 8.4.4-1.1~deb12u2, plus listed versions
8.4.2-18.4.4-18.4.4-1.1~deb12u1
8.4.4-1.1~deb12u2
frr
Debian:13
 before 10.3-3+deb13u1, plus listed versions
10.3-3
10.3-3+deb13u1
frr
Debian:14
 before 10.5.3-1, plus listed versions
10.3-310.3-410.3-510.3.1-110.3.1-2
Show 12 moreShow less
10.3.1-310.3.1-410.4.0-110.4.1-110.4.1-210.4.1-310.5.0-110.5.0-210.5.1-110.5.1-210.5.1-310.5.2-1
10.5.3-1
frr
SUSE:Linux Enterprise Server 16.0
From an advisory covering 4 CVEs
 before 10.2.6-160000.1.1
10.2.6-160000.1.1
frr
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 4 CVEs
 before 10.2.6-160000.1.1
10.2.6-160000.1.1
frr
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
Show 19 moreShow less
Affected packages
PackageAffectedFixed
frr
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-8.16.1
8.5.7-8.16.1
frr
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 4 CVEs
 before 8.5.7-8.16.1
8.5.7-8.16.1
frr
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 4 CVEs
 before 10.2.6-150700.3.10.1
10.2.6-150700.3.10.1
frr
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 3 CVEs
 before 7.4-150300.4.43.1
7.4-150300.4.43.1
frr
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 7.4-150300.4.43.1
7.4-150300.4.43.1
frr
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 7.4-150300.4.43.1
7.4-150300.4.43.1
frr
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 3 CVEs
 before 7.4-150300.4.43.1
7.4-150300.4.43.1
quagga
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.99.24.1-20.99.24.1-2ubuntu10.99.24.1-2ubuntu1.10.99.24.1-2ubuntu1.20.99.24.1-2ubuntu1.30.99.24.1-2ubuntu1.40.99.24.1-2ubuntu1.4+esm1
 None known
quagga
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.1-31.1.1-3ubuntu11.2.2-11.2.2-1ubuntu11.2.4-11.2.4-1ubuntu0.1~esm11.2.4-1ubuntu0.1~esm2
 None known
quagga
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.2.4-4build11.2.4-4ubuntu0.11.2.4-4ubuntu0.41.2.4-4ubuntu0.5
 None known
frr
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
6.0.2-2build27.2-1ubuntu17.2-1ubuntu27.2.1-17.2.1-1ubuntu0.1
Show 6 moreShow less
7.2.1-1ubuntu0.27.2.1-1ubuntu0.2+esm17.2.1-1ubuntu0.2+esm27.2.1-1ubuntu0.2+esm37.2.1-1ubuntu0.2+esm47.2.1-1ubuntu0.2+esm5
 None known
frr
Ubuntu:22.04:LTS
 before 8.1-1ubuntu1.16, plus listed versions
7.5.1-1.18.1-18.1-1ubuntu18.1-1ubuntu1.18.1-1ubuntu1.2
Show 12 moreShow less
8.1-1ubuntu1.38.1-1ubuntu1.48.1-1ubuntu1.58.1-1ubuntu1.68.1-1ubuntu1.78.1-1ubuntu1.88.1-1ubuntu1.98.1-1ubuntu1.108.1-1ubuntu1.118.1-1ubuntu1.138.1-1ubuntu1.148.1-1ubuntu1.15
8.1-1ubuntu1.16
frr
Ubuntu:24.04:LTS
 before 8.4.4-1.1ubuntu6.7, plus listed versions
8.4.4-1.1ubuntu18.4.4-1.1ubuntu38.4.4-1.1ubuntu48.4.4-1.1ubuntu58.4.4-1.1ubuntu6
Show 6 moreShow less
8.4.4-1.1ubuntu6.18.4.4-1.1ubuntu6.28.4.4-1.1ubuntu6.38.4.4-1.1ubuntu6.48.4.4-1.1ubuntu6.58.4.4-1.1ubuntu6.6
8.4.4-1.1ubuntu6.7
frr
Ubuntu:25.10
 before 10.4.1-3ubuntu1.4, plus listed versions
10.2.1-1ubuntu310.3-3ubuntu210.4.1-3ubuntu110.4.1-3ubuntu1.110.4.1-3ubuntu1.210.4.1-3ubuntu1.3
10.4.1-3ubuntu1.4
frr
Ubuntu:26.04:LTS
 before 10.5.1-1ubuntu4.1, plus listed versions
10.4.1-3ubuntu110.4.1-3ubuntu210.5.1-1ubuntu110.5.1-1ubuntu210.5.1-1ubuntu310.5.1-1ubuntu4
10.5.1-1ubuntu4.1
frr
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 10.6.1-1.1
10.6.1-1.1

History

History
RecordedChangedSources
affected
affectedOSV
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-28532 is a medium vulnerability (CVSS 6.0) in Frrouting Frr, published April 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 13th percentile. Fixed in frr 10.5.0-3.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open