Every CVE Search/ Get API key

CVE-2026-5107

FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control

2.3 LowFix available

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
Low

Exploit likelihood

0.28%Up 0.2 points since Mar 30, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.3

FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.

Record
CVE-2026-5107
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C
CVSS 3.0
4.2 MediumCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C
CVSS 2.0
3.6 AV:N/AC:H/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C
Weakness
CWE-284, CWE-266
Updated
2026-11-02
EUVDEUVD-2026-17060 2.3

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.

Record
EUVD-2026-17060
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Updated
2026-11-02
GitHub AdvisoriesGHSA-27p7-fq6v-hh4m 2.3

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function...

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.

Record
GHSA-27p7-fq6v-hh4m
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Weakness
CWE-266
Updated
2026-11-02
NVD 2.3

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.

Record
CVE-2026-5107
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS 2.0
3.6 LowAV:N/AC:H/Au:S/C:N/I:P/A:P
Weakness
CWE-266, CWE-284
Updated
2026-11-02
OSV 2.3

FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.

Record
CVE-2026-5107
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Weakness
CWE-266, CWE-284
Updated
2026-11-02
OSVDEBIAN-CVE-2026-5107 4.2

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.

Record
DEBIAN-CVE-2026-5107
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
Show 13 moreShow less
OSVUBUNTU-CVE-2026-5107 2.3

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.

Record
UBUNTU-CVE-2026-5107
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
CVSS 3.1
4.2 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Updated
2026-11-02
OSVAZL-81087 No score

CVE-2026-5107 affecting package frr for versions less than 10.5.0-2

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.

Record
AZL-81087
Updated
2026-11-02
OSVCLSA-2026-1786095204 No score

frr: Fix of CVE-2026-37460

  • CVE-2026-37460: fix missing input validation in the rfapiRibBi2Ri() RFP-option parser (bgpd/rfapi/rfapi_rib.c) allowing a bgpd DoS via a crafted BGP UPDATE with a short or zero-length VNC RFPOPTION subTLV. Scoped to the rfapi_rib.c hunk of upstream 7676cad6 to match NVD, which defines this CVE as rfapiRibBi2Ri() only; the same commit's bgp_evpn.c and bgp_evpn_mh.c hunks belong to CVE-2026-5107 and are not included
Record
CLSA-2026-1786095204
Updated
2026-11-02
OSVopenSUSE-SU-2026:10606-1 No score

frr-10.5.1-3.1 on GA media

These are all security issues fixed in the frr-10.5.1-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:10606-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20682-1 No score

Security update for frr

This update for frr fixes the following issues:

Security issues:

  • CVE-2025-61099: NULL Pointer Dereference in FRRouting (bsc#1252838).
  • CVE-2025-61100: NULL Pointer Dereference in FRRouting (bsc#1252829).
  • CVE-2025-61101: NULL Pointer Dereference in FRRouting (bsc#1252833).
  • CVE-2025-61102: NULL Pointer Dereference in FRRouting (bsc#1252835).
  • CVE-2025-61103: NULL pointer dereference in show_vty_ext_link_lan_adj_sid() in ospf_ext.c (bsc#1252810).
  • CVE-2025-61104: NULL pointer dereference in show_vty_unknown_tlv() in ospf_ext.c (bsc#1252811).
  • CVE-2025-61105: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_link_info function at ospf_ext.c (bsc#1252761).
  • CVE-2025-61106: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252812).
  • CVE-2025-61107: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252813).
  • CVE-2026-5107: A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper a (bsc#1261013).
Record
openSUSE-SU-2026:20682-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20898-1 No score

Security update for frr

This update for frr fixes the following issues:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
openSUSE-SU-2026:20898-1
Updated
2026-11-02
OSVSUSE-SU-2026:2121-1 No score

Security update for frr

This update for frr fixes the following issues:

  • CVE-2025-61099: NULL Pointer Dereference in FRRouting (bsc#1252838).
  • CVE-2025-61100: NULL Pointer Dereference in FRRouting (bsc#1252829).
  • CVE-2025-61101: NULL Pointer Dereference in FRRouting (bsc#1252833).
  • CVE-2025-61102: NULL Pointer Dereference in FRRouting (bsc#1252835).
  • CVE-2025-61103: NULL pointer dereference in show_vty_ext_link_lan_adj_sid() in ospf_ext.c (bsc#1252810).
  • CVE-2025-61104: NULL pointer dereference in show_vty_unknown_tlv() in ospf_ext.c (bsc#1252811).
  • CVE-2025-61105: NULL pointer dereference in show_vty_link_info() in ospf_ext.c (bsc#1252761).
  • CVE-2025-61106: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252812).
  • CVE-2025-61107: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252813).
  • CVE-2026-5107: Improper access controls via bgpd EVPN and ENCAP/VNC packet parsing (bsc#1261013).
Record
SUSE-SU-2026:2121-1
Updated
2026-11-02
OSVSUSE-SU-2026:21550-1 No score

Security update for frr

This update for frr fixes the following issues:

Security issues:

  • CVE-2025-61099: NULL Pointer Dereference in FRRouting (bsc#1252838).
  • CVE-2025-61100: NULL Pointer Dereference in FRRouting (bsc#1252829).
  • CVE-2025-61101: NULL Pointer Dereference in FRRouting (bsc#1252833).
  • CVE-2025-61102: NULL Pointer Dereference in FRRouting (bsc#1252835).
  • CVE-2025-61103: NULL pointer dereference in show_vty_ext_link_lan_adj_sid() in ospf_ext.c (bsc#1252810).
  • CVE-2025-61104: NULL pointer dereference in show_vty_unknown_tlv() in ospf_ext.c (bsc#1252811).
  • CVE-2025-61105: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_link_info function at ospf_ext.c (bsc#1252761).
  • CVE-2025-61106: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252812).
  • CVE-2025-61107: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252813).
  • CVE-2026-5107: A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper a (bsc#1261013).
Record
SUSE-SU-2026:21550-1
Updated
2026-11-02
OSVSUSE-SU-2026:22026-1 No score

Security update for frr

This update for frr fixes the following issues:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
SUSE-SU-2026:22026-1
Updated
2026-11-02
OSVSUSE-SU-2026:2454-1 No score

Security update for frr

This update for frr fixes the following issues

Update to frr 8.5.7:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974). DoS via a crafted UPDATE message (bsc#1263974).
Record
SUSE-SU-2026:2454-1
Updated
2026-11-02
OSVSUSE-SU-2026:2455-1 No score

Security update for frr

This update for frr fixes the following issues

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
SUSE-SU-2026:2455-1
Updated
2026-11-02
OSVSUSE-SU-2026:2457-1 No score

Security update for frr

This update for frr fixes the following issue:

  • CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
  • CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
  • CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
  • CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
Record
SUSE-SU-2026:2457-1
Updated
2026-11-02
OSVUSN-8175-1 No score

frr vulnerability

It was discovered that FRR did not correctly handle certain network requests. A remote attacker could possibly use this issue to gain unauthorized access to resources.

Record
USN-8175-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
frr
Azure Linux:3
 before 10.5.0-2
10.5.0-2
frr
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 8.5.3-9.el9_6.1.tuxcare.els2
8.5.3-9.el9_6.1.tuxcare.els2
frr-selinux
TuxCare:AlmaLinux:9.6
From an advisory covering 2 CVEs
 before 8.5.3-9.el9_6.1.tuxcare.els2
8.5.3-9.el9_6.1.tuxcare.els2
frr
Debian:12
 before 8.4.4-1.1~deb12u2, plus listed versions
8.4.2-18.4.4-18.4.4-1.1~deb12u1
8.4.4-1.1~deb12u2
frr
Debian:13
 before 10.3-3+deb13u1, plus listed versions
10.3-3
10.3-3+deb13u1
frr
Debian:14
 before 10.6.0-2, plus listed versions
10.3-310.3-410.3-510.3.1-110.3.1-2
Show 14 moreShow less
10.3.1-310.3.1-410.4.0-110.4.1-110.4.1-210.4.1-310.5.0-110.5.0-210.5.1-110.5.1-210.5.1-310.5.2-110.5.3-110.6.0-1
10.6.0-2
frr
SUSE:Linux Enterprise Server 16.0
From an advisory covering 4 CVEs
 before 10.2.6-160000.1.1
10.2.6-160000.1.1
frr
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 4 CVEs
 before 10.2.6-160000.1.1
10.2.6-160000.1.1
frr
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
frr
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 4 CVEs
 before 8.5.7-150500.4.43.1
8.5.7-150500.4.43.1
frr
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 4 CVEs
 before 8.5.7-8.16.1
8.5.7-8.16.1
frr
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 4 CVEs
 before 8.5.7-8.16.1
8.5.7-8.16.1
frr
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 4 CVEs
 before 10.2.6-150700.3.10.1
10.2.6-150700.3.10.1
quagga
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.99.24.1-20.99.24.1-2ubuntu10.99.24.1-2ubuntu1.10.99.24.1-2ubuntu1.20.99.24.1-2ubuntu1.30.99.24.1-2ubuntu1.40.99.24.1-2ubuntu1.4+esm1
 None known
quagga
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.1-31.1.1-3ubuntu11.2.2-11.2.2-1ubuntu11.2.4-11.2.4-1ubuntu0.1~esm11.2.4-1ubuntu0.1~esm2
 None known
quagga
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.2.4-4build11.2.4-4ubuntu0.11.2.4-4ubuntu0.41.2.4-4ubuntu0.5
 None known
frr
Ubuntu:Pro:20.04:LTS
 before 7.2.1-1ubuntu0.2+esm4, plus listed versions
6.0.2-2build27.2-1ubuntu17.2-1ubuntu27.2.1-17.2.1-1ubuntu0.1
Show 4 moreShow less
7.2.1-1ubuntu0.27.2.1-1ubuntu0.2+esm17.2.1-1ubuntu0.2+esm27.2.1-1ubuntu0.2+esm3
7.2.1-1ubuntu0.2+esm4
frr
Ubuntu:22.04:LTS
 before 8.1-1ubuntu1.15, plus listed versions
7.5.1-1.18.1-18.1-1ubuntu18.1-1ubuntu1.18.1-1ubuntu1.2
Show 11 moreShow less
8.1-1ubuntu1.38.1-1ubuntu1.48.1-1ubuntu1.58.1-1ubuntu1.68.1-1ubuntu1.78.1-1ubuntu1.88.1-1ubuntu1.98.1-1ubuntu1.108.1-1ubuntu1.118.1-1ubuntu1.138.1-1ubuntu1.14
8.1-1ubuntu1.15
frr
Ubuntu:24.04:LTS
 before 8.4.4-1.1ubuntu6.6, plus listed versions
8.4.4-1.1ubuntu18.4.4-1.1ubuntu38.4.4-1.1ubuntu48.4.4-1.1ubuntu58.4.4-1.1ubuntu6
Show 5 moreShow less
8.4.4-1.1ubuntu6.18.4.4-1.1ubuntu6.28.4.4-1.1ubuntu6.38.4.4-1.1ubuntu6.48.4.4-1.1ubuntu6.5
8.4.4-1.1ubuntu6.6
frr
Ubuntu:25.10
 before 10.4.1-3ubuntu1.2, plus listed versions
10.2.1-1ubuntu310.3-3ubuntu210.4.1-3ubuntu110.4.1-3ubuntu1.1
10.4.1-3ubuntu1.2
frr
openSUSE:Tumbleweed
 before 10.5.1-3.1
10.5.1-3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-5107 is a low vulnerability (CVSS 2.3) in Frrouting Frr, published March 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in frr 10.5.0-2.

References

Show 41 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open