{"id":"CVE-2023-41361","aliases":["DEBIAN-CVE-2023-41361","DLA-3573-1","EUVD-2023-45864","GHSA-v7v6-22w5-689p"],"status":"published","title":"An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large...","description":"An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00901,"percentile":0.59937,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2023-08-29T00:00:00Z","modified":"2026-10-30T02:45:19Z","fixes":[{"ecosystem":"Debian:13","package":"frr","fixed_in":["9.1-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"frr","fixed_in":["9.1-0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0-0.1","10.0-0.2","10.0-1","10.0-2","10.0.1-0.1","10.1-0.1","10.1-0.2","10.1.1-0.1","10.1.1-1","10.1.1-2","10.1.1-3","10.2-1","10.2-2","10.2.1-1","10.2.1-2","10.2.1-3","10.2.1-4","10.2.1-5","10.2.1-6","10.3-1","10.3-2","10.3-3","10.3-4","10.3-5","10.3.1-1","10.3.1-2","10.3.1-3","10.3.1-4","10.4.0-1","10.4.1-1","10.4.1-2","10.4.1-3","10.5.0-1","10.5.0-2","10.5.1-1","10.5.1-2","10.5.1-3","10.5.2-1","10.5.3-1","10.6.0-1","10.6.0-2","10.6.1-1","10.6.1-2","10.6.1-3","10.7.0-1","10.7.0-2","10.7.1-1","10.7.1-2","10.7.1-3","10.7.1-4","10.7.1-5","10.7.1-6","8.4.2-1","8.4.4-1","8.4.4-1.1","8.4.4-1.1~deb12u1","8.4.4-1.1~deb12u2","9.1-0.1"]},{"source":"osv","ecosystem":"Debian:13","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-0.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-1.1+deb10u1"}]}],"versions":["6.0.2-2","6.0.2-2+deb10u1","6.0.2-2+deb10u2","7.2-1","7.2.1-1","7.3.1-1","7.4-1","7.4-1.1","7.4-2","7.5-1","7.5.1-1","7.5.1-1.1"],"bundled":10}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"frrouting","product":"frrouting"}],"references":[{"url":"https://github.com/FRRouting/frr/pull/14241","tags":["x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00020.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41361","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v7v6-22w5-689p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41361.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-41361","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-41361","description":"An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2024-10-02T13:17:49.869Z","updated_at":"2026-11-02T14:35:19.217111Z"}],"euvd":[{"id":"EUVD-2023-45864","description":"An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2024-10-02T13:17:49Z","updated_at":"2026-11-03T00:27:59.473662Z"}],"ghsa":[{"id":"GHSA-v7v6-22w5-689p","title":"An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large...","description":"An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.","status":"published","published":"2023-08-29T06:30:14Z","modified":"2024-04-04T07:15:04Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:56:49.876332Z"}],"nvd":[{"id":"CVE-2023-41361","description":"An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.","status":"published","published":"2023-08-29T04:15:17.027Z","modified":"2026-06-17T06:21:58.667Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:08:25.025396Z"}],"osv":[{"id":"DEBIAN-CVE-2023-41361","description":"An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.","status":"published","published":"2023-08-29T04:15:17.027Z","modified":"2026-10-26T18:02:32.606731052Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"CVE-2023-41361","description":"An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version.","status":"published","published":"2023-08-29T00:00:00Z","modified":"2026-10-30T02:45:19.915306706Z","updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DLA-3573-1","title":"frr - security update","status":"published","published":"2023-09-19T00:00:00Z","modified":"2026-03-09T01:20:43.491536Z","updated_at":"2026-11-02T15:46:11.734021Z"}]}}