{"id":"CVE-2023-3748","aliases":["DEBIAN-CVE-2023-3748","EUVD-2023-44383","GHSA-w8cg-4xhg-9fgw","SUSE-SU-2023:3709-1","SUSE-SU-2024:4090-1","openSUSE-SU-2024:13191-1"],"status":"published","title":"Inifinite loop in babld message parsing may cause dos","description":"A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to enter an infinite loop and cause a denial of service.","severity":{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00772,"percentile":0.55936,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2023-07-24T15:19:20Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"Debian:12","package":"frr","fixed_in":["8.4.4-1.1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"frr","fixed_in":["9.1-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"frr","fixed_in":["9.1-0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1~deb12u2"}]}],"versions":["8.4.2-1","8.4.4-1","8.4.4-1.1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-0.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-5.1"}]}],"bundled":4}],"products":[{"vendor":"fedora","product":"fedora"},{"vendor":"frrouting","product":"frrouting"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2023-3748","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223668","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3748","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-w8cg-4xhg-9fgw"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://packages.fedoraproject.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/3xxx/CVE-2023-3748.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-3748","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233709-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1213284","tags":["report"]},{"url":"https://bugzilla.suse.com/1213434","tags":["report"]},{"url":"https://bugzilla.suse.com/1214735","tags":["report"]},{"url":"https://bugzilla.suse.com/1214739","tags":["report"]},{"url":"https://bugzilla.suse.com/1215065","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41909","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244090-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44070","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-3748","title":"Inifinite loop in babld message parsing may cause dos","description":"A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to enter an infinite loop and cause a denial of service.","status":"published","published":"2023-07-24T15:19:20.511Z","modified":"2024-09-27T13:44:27.663Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:35:24.707957Z"}],"euvd":[{"id":"EUVD-2023-44383","description":"A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to enter an infinite loop and cause a denial of service.","status":"published","published":"2023-07-24T15:19:20Z","modified":"2024-09-27T13:44:27Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T00:28:06.341022Z"}],"ghsa":[{"id":"GHSA-w8cg-4xhg-9fgw","title":"A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are...","description":"A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to enter an infinite loop and cause a denial of service.","status":"published","published":"2023-07-24T18:30:44Z","modified":"2024-04-04T06:20:20Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:56:41.519501Z"}],"nvd":[{"id":"CVE-2023-3748","description":"A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to enter an infinite loop and cause a denial of service.","status":"published","published":"2023-07-24T16:15:13.203Z","modified":"2026-06-17T06:14:45.837Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:08:18.687088Z"}],"osv":[{"id":"CVE-2023-3748","title":"Inifinite loop in babld message parsing may cause dos","description":"A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to enter an infinite loop and cause a denial of service.","status":"published","published":"2023-07-24T15:19:20.511Z","modified":"2026-10-28T02:30:39.33467639Z","cvss":[{"version":"3.1","score":3.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:44:32.510144Z"},{"id":"DEBIAN-CVE-2023-3748","description":"A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send specially crafted hello messages with the unicast flag set, the interval field set to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to enter an infinite loop and cause a denial of service.","status":"published","published":"2023-07-24T16:15:13.203Z","modified":"2026-10-26T18:02:40.638757915Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"openSUSE-SU-2024:13191-1","title":"frr-8.4-5.1 on GA media","description":"These are all security issues fixed in the frr-8.4-5.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:21:40.356011Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"SUSE-SU-2023:3709-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2023-38802: Fixed bad length handling in BGP attribute handling (bsc#1213284). \n- CVE-2023-41358: Fixed crash in bgpd/bgp_packet.c (bsc#1214735).\n- CVE-2023-41360: Fixed out-of-bounds read in bgpd/bgp_packet.c (bsc#1214739).\n- CVE-2023-3748: Fixed inifinite loop in babld message parsing may cause DoS (bsc#1213434).\n- CVE-2023-41909: Fixed NULL pointer dereference due to processing in bgp_nlri_parse_flowspec (bsc#1215065).\n","status":"published","published":"2023-09-20T16:04:43Z","modified":"2025-05-02T04:35:09.191767Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2024:4090-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\nUpdate to frr 8.5.6 (jsc#PED-PED-11092) including fixes for:\n\n- CVE-2024-44070,CVE-2024-34088,CVE-2024-31951,CVE-2024-31950,\n  CVE-2024-31948,CVE-2024-27913,CVE-2023-47235,CVE-2023-47234,\n  CVE-2023-46753,CVE-2023-46752,CVE-2023-41909,CVE-2023-41360,\n  CVE-2023-41358,CVE-2023-38802,CVE-2023-38407,CVE-2023-38406,\n  CVE-2023-3748,CVE-2023-31490,CVE-2023-31489 and other bugfixes.\n  See https://frrouting.org/release/8.5.6/ for details.\n\nThe most recent frr 8.x series provides several new features,\nimprovements and bug fixes for various protocols and daemons,\nespecially for PIM/PIMv6/BGP and VRF support.\n\nSee https://frrouting.org/release/8.5/ for details and links.\n","status":"published","published":"2024-11-28T07:57:59Z","modified":"2026-02-04T04:12:19.142034Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}