Every CVE Search/ Get API key

CVE-2026-37460

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable...

7.5 HighFix available

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.34%Up 0.3 points since Jun 4, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
CVE-2026-37460
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
EUVDEUVD-2026-34083 7.5

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
EUVD-2026-34083
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-4ph9-3c4q-r2hh 7.5

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable...

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
GHSA-4ph9-3c4q-r2hh
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
NVD 7.5

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
CVE-2026-37460
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-20
Updated
2026-11-02
OSV 7.5

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
CVE-2026-37460
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2026-37460 7.5

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
DEBIAN-CVE-2026-37460
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 13 moreShow less
OSVRHSA-2026:24347 7.5

Red Hat Security Advisory: frr security update

Record
RHSA-2026:24347
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:49511 7.5

Red Hat Security Advisory: frr security update

Record
RHSA-2026:49511
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:49527 7.5

Red Hat Security Advisory: frr security, bug fix, and enhancement update

Record
RHSA-2026:49527
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2026:49607 7.5

Red Hat Security Advisory: frr10 security, bug fix, and enhancement update

Record
RHSA-2026:49607
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:49511 7.5

Important: frr security update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

  • frr: FRRouting: Denial of Service via crafted BGP UPDATE message (CVE-2026-37460)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:49511
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:49527 7.5

Important: frr security, bug fix, and enhancement update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

  • frr: FRRouting: Denial of Service via crafted BGP UPDATE message (CVE-2026-37460)

Bug Fix(es) and Enhancement(s):

  • Zebra is not installing the route in the kernel after flapping one of the physical link on the ocp worker node. [rhel-9.8.z] (JIRA:Rocky Linux-152300)

  • frr triggers SELinux denials when reading root's Python site-packages directory on Rocky Linux-9 (JIRA:Rocky Linux-176258)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:49527
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2026:49607 7.5

Important: frr10 security, bug fix, and enhancement update

FRRouting is free software that manages TCP/IP based routing protocols. It takes a multi-server and multi-threaded approach to resolve the current complexity of the Internet. FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. FRRouting is a fork of Quagga.

Security Fix(es):

  • frr: FRRouting: Denial of Service via crafted BGP UPDATE message (CVE-2026-37460)

Bug Fix(es) and Enhancement(s):

  • frr10 triggers SELinux denials when reading root's Python site-packages directory on Rocky Linux-9 (JIRA:Rocky Linux-222338)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:49607
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-37460 7.5

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Record
UBUNTU-CVE-2026-37460
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2026:49511 No score

Important: frr security update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

  • frr: FRRouting: Denial of Service via crafted BGP UPDATE message (CVE-2026-37460)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:49511
Updated
2026-11-02
OSVALSA-2026:49527 No score

Important: frr security, bug fix, and enhancement update

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

  • frr: FRRouting: Denial of Service via crafted BGP UPDATE message (CVE-2026-37460)

Bug Fix(es) and Enhancement(s):

  • Zebra is not installing the route in the kernel after flapping one of the physical link on the ocp worker node. [almalinux-9.8.z] (JIRA:AlmaLinux-152300)
  • frr triggers SELinux denials when reading root's Python site-packages directory on AlmaLinux-9 (JIRA:AlmaLinux-176258)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:49527
Updated
2026-11-02
OSVALSA-2026:49607 No score

Important: frr10 security, bug fix, and enhancement update

FRRouting is free software that manages TCP/IP based routing protocols. It takes a multi-server and multi-threaded approach to resolve the current complexity of the Internet. FRRouting supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. FRRouting is a fork of Quagga.

Security Fix(es):

  • frr: FRRouting: Denial of Service via crafted BGP UPDATE message (CVE-2026-37460)

Bug Fix(es) and Enhancement(s):

  • frr10 triggers SELinux denials when reading root's Python site-packages directory on AlmaLinux-9 (JIRA:AlmaLinux-222338)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:49607
Updated
2026-11-02
OSVCLSA-2026-1786035720 No score

frr: Fix of CVE-2026-37460

  • CVE-2026-37460: validate RFPOPTION sub-TLV length before accessing its data
Record
CLSA-2026-1786035720
Updated
2026-11-02
OSVCLSA-2026-1786095204 No score

frr: Fix of CVE-2026-37460

  • CVE-2026-37460: fix missing input validation in the rfapiRibBi2Ri() RFP-option parser (bgpd/rfapi/rfapi_rib.c) allowing a bgpd DoS via a crafted BGP UPDATE with a short or zero-length VNC RFPOPTION subTLV. Scoped to the rfapi_rib.c hunk of upstream 7676cad6 to match NVD, which defines this CVE as rfapiRibBi2Ri() only; the same commit's bgp_evpn.c and bgp_evpn_mh.c hunks belong to CVE-2026-5107 and are not included
Record
CLSA-2026-1786095204
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
frr
AlmaLinux:8
 before 7.5.1-25.el8_10
7.5.1-25.el8_10
frr-selinux
AlmaLinux:8
 before 7.5.1-25.el8_10
7.5.1-25.el8_10
frr
AlmaLinux:9
 before 8.5.3-15.el9_8.1
8.5.3-15.el9_8.1
frr-selinux
AlmaLinux:9
 before 8.5.3-15.el9_8.1
8.5.3-15.el9_8.1
frr10
AlmaLinux:9
 before 10.4.3-3.el9_8.2
10.4.3-3.el9_8.2
frr10-selinux
AlmaLinux:9
 before 10.4.3-3.el9_8.2
10.4.3-3.el9_8.2
frr
TuxCare:AlmaLinux:9.2
 before 8.3.1-5.el9_2.2.alma.tuxcare.els6
8.3.1-5.el9_2.2.alma.tuxcare.els6
frr-selinux
TuxCare:AlmaLinux:9.2
 before 8.3.1-5.el9_2.2.alma.tuxcare.els6
8.3.1-5.el9_2.2.alma.tuxcare.els6
frr
TuxCare:AlmaLinux:9.6
 before 8.5.3-9.el9_6.1.tuxcare.els2
8.5.3-9.el9_6.1.tuxcare.els2
frr-selinux
TuxCare:AlmaLinux:9.6
 before 8.5.3-9.el9_6.1.tuxcare.els2
8.5.3-9.el9_6.1.tuxcare.els2
Show 29 moreShow less
Affected packages
PackageAffectedFixed
frr
Debian:12
 All versions, plus listed versions
10.0-0.110.0-0.210.0-110.0-210.0.1-0.1
Show 45 moreShow less
10.1-0.110.1-0.210.1.1-0.110.1.1-110.1.1-210.1.1-310.2-110.2-210.2.1-110.2.1-210.2.1-310.2.1-410.2.1-510.2.1-610.3-110.3-210.3-310.3-410.3-510.3.1-110.3.1-210.3.1-310.3.1-410.4.0-110.4.1-110.4.1-210.4.1-310.5.0-110.5.0-210.5.1-110.5.1-210.5.1-310.5.2-110.5.3-110.6.0-110.6.0-210.6.1-110.6.1-210.6.1-310.7.0-110.7.0-210.7.1-110.7.1-210.7.1-38.4.2-1
 None known
frr
Debian:13
 All versions, plus listed versions
10.3-310.3-3+deb13u110.3-410.3-510.3.1-1
Show 24 moreShow less
10.3.1-210.3.1-310.3.1-410.4.0-110.4.1-110.4.1-210.4.1-310.5.0-110.5.0-210.5.1-110.5.1-210.5.1-310.5.2-110.5.3-110.6.0-110.6.0-210.6.1-110.6.1-210.6.1-310.7.0-110.7.0-210.7.1-110.7.1-210.7.1-3
 None known
frr
Debian:14
 before 10.6.1-1, plus listed versions
10.3-310.3-410.3-510.3.1-110.3.1-2
Show 15 moreShow less
10.3.1-310.3.1-410.4.0-110.4.1-110.4.1-210.4.1-310.5.0-110.5.0-210.5.1-110.5.1-210.5.1-310.5.2-110.5.3-110.6.0-110.6.0-2
10.6.1-1
frr
Red Hat:enterprise_linux:10.2
 before 0:10.4.4-1.el10_2
0:10.4.4-1.el10_2
frr-debuginfo
Red Hat:enterprise_linux:10.2
 before 0:10.4.4-1.el10_2
0:10.4.4-1.el10_2
frr-debugsource
Red Hat:enterprise_linux:10.2
 before 0:10.4.4-1.el10_2
0:10.4.4-1.el10_2
frr-selinux
Red Hat:enterprise_linux:10.2
 before 0:10.4.4-1.el10_2
0:10.4.4-1.el10_2
frr
Red Hat:enterprise_linux:8::appstream
 before 0:7.5.1-25.el8_10
0:7.5.1-25.el8_10
frr-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:7.5.1-25.el8_10
0:7.5.1-25.el8_10
frr-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:7.5.1-25.el8_10
0:7.5.1-25.el8_10
frr-selinux
Red Hat:enterprise_linux:8::appstream
 before 0:7.5.1-25.el8_10
0:7.5.1-25.el8_10
frr
Red Hat:enterprise_linux:9::appstream
 before 0:8.5.3-15.el9_8.1
0:8.5.3-15.el9_8.1
frr-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:8.5.3-15.el9_8.1
0:8.5.3-15.el9_8.1
frr-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:8.5.3-15.el9_8.1
0:8.5.3-15.el9_8.1
frr-selinux
Red Hat:enterprise_linux:9::appstream
 before 0:8.5.3-15.el9_8.1
0:8.5.3-15.el9_8.1
frr10
Red Hat:enterprise_linux:9::appstream
 before 0:10.4.3-3.el9_8.2
0:10.4.3-3.el9_8.2
frr10-debuginfo
Red Hat:enterprise_linux:9::appstream
 before 0:10.4.3-3.el9_8.2
0:10.4.3-3.el9_8.2
frr10-debugsource
Red Hat:enterprise_linux:9::appstream
 before 0:10.4.3-3.el9_8.2
0:10.4.3-3.el9_8.2
frr10-selinux
Red Hat:enterprise_linux:9::appstream
 before 0:10.4.3-3.el9_8.2
0:10.4.3-3.el9_8.2
frr
Rocky Linux:8
 before 0:7.5.1-25.el8_10
0:7.5.1-25.el8_10
frr
Rocky Linux:9
 before 0:8.5.3-15.el9_8.1
0:8.5.3-15.el9_8.1
frr10
Rocky Linux:9
 before 0:10.4.3-3.el9_8.2
0:10.4.3-3.el9_8.2
quagga
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.99.24.1-20.99.24.1-2ubuntu10.99.24.1-2ubuntu1.10.99.24.1-2ubuntu1.20.99.24.1-2ubuntu1.30.99.24.1-2ubuntu1.40.99.24.1-2ubuntu1.4+esm1
 None known
quagga
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.1-31.1.1-3ubuntu11.2.2-11.2.2-1ubuntu11.2.4-11.2.4-1ubuntu0.1~esm11.2.4-1ubuntu0.1~esm2
 None known
quagga
Ubuntu:20.04:LTS
 All versions, plus listed versions
1.2.4-4build11.2.4-4ubuntu0.11.2.4-4ubuntu0.41.2.4-4ubuntu0.5
 None known
frr
Ubuntu:Pro:20.04:LTS
 before 7.2.1-1ubuntu0.2+esm4, plus listed versions
6.0.2-2build27.2-1ubuntu17.2-1ubuntu27.2.1-17.2.1-1ubuntu0.1
Show 4 moreShow less
7.2.1-1ubuntu0.27.2.1-1ubuntu0.2+esm17.2.1-1ubuntu0.2+esm27.2.1-1ubuntu0.2+esm3
7.2.1-1ubuntu0.2+esm4
frr
Ubuntu:22.04:LTS
 before 8.1-1ubuntu1.15, plus listed versions
7.5.1-1.18.1-18.1-1ubuntu18.1-1ubuntu1.18.1-1ubuntu1.2
Show 11 moreShow less
8.1-1ubuntu1.38.1-1ubuntu1.48.1-1ubuntu1.58.1-1ubuntu1.68.1-1ubuntu1.78.1-1ubuntu1.88.1-1ubuntu1.98.1-1ubuntu1.108.1-1ubuntu1.118.1-1ubuntu1.138.1-1ubuntu1.14
8.1-1ubuntu1.15
frr
Ubuntu:24.04:LTS
 before 8.4.4-1.1ubuntu6.6, plus listed versions
8.4.4-1.1ubuntu18.4.4-1.1ubuntu38.4.4-1.1ubuntu48.4.4-1.1ubuntu58.4.4-1.1ubuntu6
Show 5 moreShow less
8.4.4-1.1ubuntu6.18.4.4-1.1ubuntu6.28.4.4-1.1ubuntu6.38.4.4-1.1ubuntu6.48.4.4-1.1ubuntu6.5
8.4.4-1.1ubuntu6.6
frr
Ubuntu:25.10
 before 10.4.1-3ubuntu1.2, plus listed versions
10.2.1-1ubuntu310.3-3ubuntu210.4.1-3ubuntu110.4.1-3ubuntu1.1
10.4.1-3ubuntu1.2

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-37460 is a high vulnerability (CVSS 7.5) in frr, published June 3, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 26th percentile. Fixed in frr 7.5.1-25.el8_10.

References

Show 37 moreShow less
This page doesn't list everything

Left out here: 5 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open