Every CVE Search/ Get API key

CVE-2026-37459

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a...

7.5 HighFix available

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.37%Up 0.3 points since May 5, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
CVE-2026-37459
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-191
Updated
2026-11-02
EUVDEUVD-2026-27047 7.5

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
EUVD-2026-27047
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-hmpg-chwg-jvg8 7.5

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a...

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
GHSA-hmpg-chwg-jvg8
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-191, CWE-400
Updated
2026-11-02
NVD 7.5

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
CVE-2026-37459
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-191
Updated
2026-11-02
OSV 7.5

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
CVE-2026-37459
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-37459 7.5

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
DEBIAN-CVE-2026-37459
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVRHSA-2026:24347 7.5

Red Hat Security Advisory: frr security update

Record
RHSA-2026:24347
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:24370 7.5

Red Hat Security Advisory: frr10 security update

Record
RHSA-2026:24370
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:24347 7.5

Important: frr security update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

  • frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

  • frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:24347
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:24370 7.5

Important: frr10 security update

FRRouting is free software that manages TCP/IP based routing protocols. It takes a multi-server and multi-threaded approach to resolve the current complexity of the Internet. FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. FRRouting is a fork of Quagga.

Security Fix(es):

  • frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

  • frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:24370
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-37459 7.5

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
UBUNTU-CVE-2026-37459
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:24347 No score

Important: frr security update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

  • frr: denial of service via crafted FlowSpec component (CVE-2026-37457)
  • frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:24347
Updated
2026-11-02
OSVALSA-2026:24370 No score

Important: frr10 security update

FRRouting is free software that manages TCP/IP based routing protocols. It takes a multi-server and multi-threaded approach to resolve the current complexity of the Internet. FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. FRRouting is a fork of Quagga.

Security Fix(es):

  • frr: denial of service via crafted FlowSpec component (CVE-2026-37457)
  • frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:24370
Updated
2026-11-02
OSVAZL-86217 No score

CVE-2026-37459 affecting package frr for versions less than 10.5.4-1

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
AZL-86217
Updated
2026-11-02
OSVopenSUSE-SU-2026:10721-1 No score

frr-10.6.1-1.1 on GA media

These are all security issues fixed in the frr-10.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10721-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
frr
AlmaLinux:10
 before 10.4.4-1.el10_2
10.4.4-1.el10_2
frr-selinux
AlmaLinux:10
 before 10.4.4-1.el10_2
10.4.4-1.el10_2
frr10
AlmaLinux:9
 before 10.4.3-3.el9_8
10.4.3-3.el9_8
frr10-selinux
AlmaLinux:9
 before 10.4.3-3.el9_8
10.4.3-3.el9_8
frr
Azure Linux:3
 before 10.5.4-1
10.5.4-1
frr
Debian:14
 before 10.6.0-2, plus listed versions
10.3-310.3-410.3-510.3.1-110.3.1-2
Show 14 moreShow less
10.3.1-310.3.1-410.4.0-110.4.1-110.4.1-210.4.1-310.5.0-110.5.0-210.5.1-110.5.1-210.5.1-310.5.2-110.5.3-110.6.0-1
10.6.0-2
frr
Red Hat:enterprise_linux:10.2
 before 0:10.4.4-1.el10_2
0:10.4.4-1.el10_2
frr-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:10.4.4-1.el10_2
0:10.4.4-1.el10_2
frr-debugsource
Red Hat:enterprise_linux:10.2
 before 0:10.4.4-1.el10_2
0:10.4.4-1.el10_2
frr-selinux
Red Hat:enterprise_linux:10.2
 before 0:10.4.4-1.el10_2
0:10.4.4-1.el10_2
Show 12 moreShow less
Affected packages
PackageAffectedFixed
frr10
Red Hat:enterprise_linux:9::appstream
 before 0:10.4.3-3.el9_8
0:10.4.3-3.el9_8
frr10-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:10.4.3-3.el9_8
0:10.4.3-3.el9_8
frr10-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:10.4.3-3.el9_8
0:10.4.3-3.el9_8
frr10-selinux
Red Hat:enterprise_linux:9::appstream
 before 0:10.4.3-3.el9_8
0:10.4.3-3.el9_8
frr
Rocky Linux:10
 before 0:10.4.4-1.el10_2
0:10.4.4-1.el10_2
frr10
Rocky Linux:9
 before 0:10.4.3-3.el9_8
0:10.4.3-3.el9_8
quagga
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.99.24.1-20.99.24.1-2ubuntu10.99.24.1-2ubuntu1.10.99.24.1-2ubuntu1.20.99.24.1-2ubuntu1.30.99.24.1-2ubuntu1.40.99.24.1-2ubuntu1.4+esm1
 None known
quagga
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.1-31.1.1-3ubuntu11.2.2-11.2.2-1ubuntu11.2.4-11.2.4-1ubuntu0.1~esm11.2.4-1ubuntu0.1~esm2
 None known
quagga
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.2.4-4build11.2.4-4ubuntu0.11.2.4-4ubuntu0.41.2.4-4ubuntu0.5
 None known
frr
Ubuntu:25.10
 before 10.4.1-3ubuntu1.4, plus listed versions
10.2.1-1ubuntu310.3-3ubuntu210.4.1-3ubuntu110.4.1-3ubuntu1.110.4.1-3ubuntu1.210.4.1-3ubuntu1.3
10.4.1-3ubuntu1.4
frr
Ubuntu:26.04:LTS
 before 10.5.1-1ubuntu4.1, plus listed versions
10.4.1-3ubuntu110.4.1-3ubuntu210.5.1-1ubuntu110.5.1-1ubuntu210.5.1-1ubuntu310.5.1-1ubuntu4
10.5.1-1ubuntu4.1
frr
openSUSE:Tumbleweed
 before 10.6.1-1.1
10.6.1-1.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-37459 is a high vulnerability (CVSS 7.5) in Red Hat Enterprise Linux 10, published May 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in frr 10.4.4-1.el10_2.

References

Show 33 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open