Every CVE Search/ Get API key

CVE-2026-37458

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable...

6.5 MediumFix available

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.25%Up 0.2 points since May 5, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.5

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

Record
CVE-2026-37458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2026-26977 6.5

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

Record
EUVD-2026-26977
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-m357-6hwr-7w53 6.5

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable...

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

Record
GHSA-m357-6hwr-7w53
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
NVD 6.5

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

Record
CVE-2026-37458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 6.5

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

Record
CVE-2026-37458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-37458 6.5

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

Record
DEBIAN-CVE-2026-37458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVUBUNTU-CVE-2026-37458 6.5

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

Record
UBUNTU-CVE-2026-37458
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-05
OSVAZL-86214 No score

CVE-2026-37458 affecting package frr for versions less than 10.5.4-1

Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.

Record
AZL-86214
Updated
2026-11-02
OSVopenSUSE-SU-2026:10721-1 No score

frr-10.6.1-1.1 on GA media

These are all security issues fixed in the frr-10.6.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10721-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20898-1 No score

Security update for frr

This update for frr fixes the following issues:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
openSUSE-SU-2026:20898-1
Updated
2026-11-02
OSVSUSE-SU-2026:22026-1 No score

Security update for frr

This update for frr fixes the following issues:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
SUSE-SU-2026:22026-1
Updated
2026-11-02
OSVSUSE-SU-2026:2454-1 No score

Security update for frr

This update for frr fixes the following issues

Update to frr 8.5.7:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974). DoS via a crafted UPDATE message (bsc#1263974).
Record
SUSE-SU-2026:2454-1
Updated
2026-11-02
OSVSUSE-SU-2026:2455-1 No score

Security update for frr

This update for frr fixes the following issues

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
SUSE-SU-2026:2455-1
Updated
2026-11-02
OSVSUSE-SU-2026:2457-1 No score

Security update for frr

This update for frr fixes the following issue:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
SUSE-SU-2026:2457-1
Updated
2026-11-02
OSVSUSE-SU-2026:2644-1 No score

Security update for frr

This update for frr fixes the following issues

  • CVE-2026-28532: Denial of Service due to integer overflow in OSPF TLV parser functions (bsc#1263859).
  • CVE-2026-37457: An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (bsc#1263863).
  • CVE-2026-37458: missing input validation in the MP_REACH_NLRI component allows authenticated attackers to cause a DoS via a crafted UPDATE message (bsc#1263974).
Record
SUSE-SU-2026:2644-1
Updated
2026-11-02
OSVSUSE-SU-2026:3868-1 No score

Security update for quagga

This update for quagga fixes the following issue:

  • CVE-2026-37458: missing input validation in the MP_REACH_NLRI component allows authenticated attackers to cause a DoS via a crafted UPDATE message (bsc#1263974).
Record
SUSE-SU-2026:3868-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
frr
Azure Linux:3
 before 10.5.4-1
10.5.4-1
frr
Debian:12
 before 8.4.4-1.1~deb12u2, plus listed versions
8.4.2-18.4.4-18.4.4-1.1~deb12u1
8.4.4-1.1~deb12u2
frr
Debian:13
 before 10.3-3+deb13u1, plus listed versions
10.3-3
10.3-3+deb13u1
frr
Debian:14
 before 10.6.0-2, plus listed versions
10.3-310.3-410.3-510.3.1-110.3.1-2
Show 14 moreShow less
10.3.1-310.3.1-410.4.0-110.4.1-110.4.1-210.4.1-310.5.0-110.5.0-210.5.1-110.5.1-210.5.1-310.5.2-110.5.3-110.6.0-1
10.6.0-2
frr
SUSE:Linux Enterprise Server 16.0
From an advisory covering 4 CVEs
 before 10.2.6-160000.1.1
10.2.6-160000.1.1
frr
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 4 CVEs
 before 10.2.6-160000.1.1
10.2.6-160000.1.1
frr
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
Show 20 moreShow less
Affected packages
PackageAffectedFixed
frr
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-8.16.1
8.5.7-8.16.1
frr
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 4 CVEs
 before 8.5.7-8.16.1
8.5.7-8.16.1
frr
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 4 CVEs
 before 10.2.6-150700.3.10.1
10.2.6-150700.3.10.1
frr
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 3 CVEs
 before 7.4-150300.4.43.1
7.4-150300.4.43.1
frr
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 7.4-150300.4.43.1
7.4-150300.4.43.1
frr
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 3 CVEs
 before 7.4-150300.4.43.1
7.4-150300.4.43.1
frr
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 3 CVEs
 before 7.4-150300.4.43.1
7.4-150300.4.43.1
quagga
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.1.1-17.16.1
1.1.1-17.16.1
quagga
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.99.24.1-20.99.24.1-2ubuntu10.99.24.1-2ubuntu1.10.99.24.1-2ubuntu1.20.99.24.1-2ubuntu1.30.99.24.1-2ubuntu1.40.99.24.1-2ubuntu1.4+esm1
 None known
quagga
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.1-31.1.1-3ubuntu11.2.2-11.2.2-1ubuntu11.2.4-11.2.4-1ubuntu0.1~esm11.2.4-1ubuntu0.1~esm2
 None known
quagga
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.2.4-4build11.2.4-4ubuntu0.11.2.4-4ubuntu0.41.2.4-4ubuntu0.5
 None known
frr
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
6.0.2-2build27.2-1ubuntu17.2-1ubuntu27.2.1-17.2.1-1ubuntu0.1
Show 6 moreShow less
7.2.1-1ubuntu0.27.2.1-1ubuntu0.2+esm17.2.1-1ubuntu0.2+esm27.2.1-1ubuntu0.2+esm37.2.1-1ubuntu0.2+esm47.2.1-1ubuntu0.2+esm5
 None known
frr
Ubuntu:22.04:LTS
 before 8.1-1ubuntu1.16, plus listed versions
7.5.1-1.18.1-18.1-1ubuntu18.1-1ubuntu1.18.1-1ubuntu1.2
Show 12 moreShow less
8.1-1ubuntu1.38.1-1ubuntu1.48.1-1ubuntu1.58.1-1ubuntu1.68.1-1ubuntu1.78.1-1ubuntu1.88.1-1ubuntu1.98.1-1ubuntu1.108.1-1ubuntu1.118.1-1ubuntu1.138.1-1ubuntu1.148.1-1ubuntu1.15
8.1-1ubuntu1.16
frr
Ubuntu:24.04:LTS
 before 8.4.4-1.1ubuntu6.7, plus listed versions
8.4.4-1.1ubuntu18.4.4-1.1ubuntu38.4.4-1.1ubuntu48.4.4-1.1ubuntu58.4.4-1.1ubuntu6
Show 6 moreShow less
8.4.4-1.1ubuntu6.18.4.4-1.1ubuntu6.28.4.4-1.1ubuntu6.38.4.4-1.1ubuntu6.48.4.4-1.1ubuntu6.58.4.4-1.1ubuntu6.6
8.4.4-1.1ubuntu6.7
frr
Ubuntu:25.10
 before 10.4.1-3ubuntu1.4, plus listed versions
10.2.1-1ubuntu310.3-3ubuntu210.4.1-3ubuntu110.4.1-3ubuntu1.110.4.1-3ubuntu1.210.4.1-3ubuntu1.3
10.4.1-3ubuntu1.4
frr
Ubuntu:26.04:LTS
 before 10.5.1-1ubuntu4.1, plus listed versions
10.4.1-3ubuntu110.4.1-3ubuntu210.5.1-1ubuntu110.5.1-1ubuntu210.5.1-1ubuntu310.5.1-1ubuntu4
10.5.1-1ubuntu4.1
frr
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 10.6.1-1.1
10.6.1-1.1

History

History
RecordedChangedSources
affected
affected, factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-37458 is a medium vulnerability (CVSS 6.5) in Frrouting, published May 4, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.25%, the 16th percentile. Fixed in frr 10.5.4-1.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open