{"id":"CVE-2023-46752","aliases":["ALSA-2024:2156","ALSA-2024:2981","AZL-31700","AZL-34692","CLSA-2026-1778238289","DEBIAN-CVE-2023-46752","DLA-3797-1","DLA-3865-1","EUVD-2023-50919","GHSA-v7w5-g2hv-9797","RHSA-2024:2156","RHSA-2024:2981","RLSA-2024:2981","SUSE-SU-2023:4473-1","SUSE-SU-2023:4483-1","SUSE-SU-2024:4090-1","UBUNTU-CVE-2023-46752","USN-6481-1","USN-6807-1","openSUSE-SU-2024:13387-1"],"status":"published","title":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI...","description":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.0102,"percentile":0.63681,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-10-26T00:00:00Z","modified":"2026-10-29T11:31:42Z","fixes":[{"ecosystem":"Azure Linux:2","package":"frr","fixed_in":["8.5.3-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"frr","fixed_in":["9.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"frr","fixed_in":["9.1-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"frr","fixed_in":["9.1-0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","fixed_in":["7.2.1-1ubuntu0.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"frr","fixed_in":["8.1-1ubuntu1.7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:9","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"AlmaLinux:8","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-22.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:8","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-22.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:2","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.3-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.1-5.el9_2.2.alma.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.3.1-5.el9_2.2.alma.tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0-0.1","10.0-0.2","10.0-1","10.0-2","10.0.1-0.1","10.1-0.1","10.1-0.2","10.1.1-0.1","10.1.1-1","10.1.1-2","10.1.1-3","10.2-1","10.2-2","10.2.1-1","10.2.1-2","10.2.1-3","10.2.1-4","10.2.1-5","10.2.1-6","10.3-1","10.3-2","10.3-3","10.3-4","10.3-5","10.3.1-1","10.3.1-2","10.3.1-3","10.3.1-4","10.4.0-1","10.4.1-1","10.4.1-2","10.4.1-3","10.5.0-1","10.5.0-2","10.5.1-1","10.5.1-2","10.5.1-3","10.5.2-1","10.5.3-1","10.6.0-1","10.6.0-2","10.6.1-1","10.6.1-2","10.6.1-3","10.7.0-1","10.7.0-2","10.7.1-1","10.7.1-2","10.7.1-3","10.7.1-4","10.7.1-5","10.7.1-6","8.4.2-1","8.4.4-1","8.4.4-1.1","8.4.4-1.1~deb12u1","8.4.4-1.1~deb12u2","9.1-0.1"]},{"source":"osv","ecosystem":"Debian:13","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1-0.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-1.1+deb10u2"}]}],"versions":["6.0.2-2","6.0.2-2+deb10u1","6.0.2-2+deb10u2","7.2-1","7.2.1-1","7.3.1-1","7.4-1","7.4-1.1","7.4-2","7.5-1","7.5.1-1","7.5.1-1.1","7.5.1-1.1+deb10u1"],"bundled":14},{"source":"osv","ecosystem":"Debian:11","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-1.1+deb11u3"}]}],"versions":["7.5.1-1.1","7.5.1-1.1+deb11u1","7.5.1-1.1+deb11u2"],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.5.3-4.el9"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.1-22.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.1-22.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.1-22.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.1-22.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:8","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.5.1-22.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.11.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-150300.4.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.4-150300.4.20.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1-1ubuntu0.2+esm2"}]}],"versions":["6.0.2-2build2","7.2-1ubuntu1","7.2-1ubuntu2","7.2.1-1","7.2.1-1ubuntu0.1","7.2.1-1ubuntu0.2","7.2.1-1ubuntu0.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.7"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4","8.1-1ubuntu1.5","8.1-1ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.7"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4","8.1-1ubuntu1.5","8.1-1ubuntu1.6"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1-1ubuntu0.2+esm2"}]}],"versions":["6.0.2-2build2","7.2-1ubuntu1","7.2-1ubuntu2","7.2.1-1","7.2.1-1ubuntu0.1","7.2.1-1ubuntu0.2","7.2.1-1ubuntu0.2+esm1"],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-7.1"}]}],"bundled":2}],"products":[{"vendor":"frrouting","product":"frrouting"}],"references":[{"url":"https://github.com/FRRouting/frr/pull/14645/commits/b08afc81c60607a4f736f418f2e3eb06087f1a35","tags":["x_transferred","Patch","web","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html","tags":["mailing-list","x_transferred","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00007.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46752","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-v7w5-g2hv-9797"},{"url":"https://access.redhat.com/errata/RHSA-2024:2156","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-31489","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-31490","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41358","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41359","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41360","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41909","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46752","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-46753","tags":["report"]},{"url":"https://bugzilla.redhat.com/2235839","tags":["report"]},{"url":"https://bugzilla.redhat.com/2235840","tags":["report"]},{"url":"https://bugzilla.redhat.com/2235842","tags":["report"]},{"url":"https://bugzilla.redhat.com/2237416","tags":["report"]},{"url":"https://bugzilla.redhat.com/2238990","tags":["report"]},{"url":"https://bugzilla.redhat.com/2238992","tags":["report"]},{"url":"https://bugzilla.redhat.com/2246379","tags":["report"]},{"url":"https://bugzilla.redhat.com/2246381","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2156.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2981","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2024-2981.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778238289.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/46xxx/CVE-2023-46752.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-46752","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235840","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2235842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246381","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-11664","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-15291","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2156.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-31489","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31489","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-31490","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-31490","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41358","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41358","tags":["advisory"]},{"url":"https://github.com/FRRouting/frr/pull/14260","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41359","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41359","tags":["advisory"]},{"url":"https://github.com/FRRouting/frr/pull/14232","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41360","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41360","tags":["advisory"]},{"url":"https://github.com/FRRouting/frr/pull/14245","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41909","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41909","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46752","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-46753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-46753","tags":["advisory"]},{"url":"https://github.com/FRRouting/frr/pull/14645/commits/d8482bf011cb2b173e85b65b4bf3d5061250cdb9","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-12039","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-22303","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-2263","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-6583","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2981.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2981","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234473-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216626","tags":["report"]},{"url":"https://bugzilla.suse.com/1216627","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46753","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234483-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244090-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44070","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-46752","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6481-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6807-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-46753","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26126","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26127","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26128","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-26129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-37035","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-31490","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-38406","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-38407","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-38802","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-47234","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-47235","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-31948","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-46752","description":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.","status":"published","published":"2023-10-26T00:00:00Z","modified":"2025-11-04T16:10:40.016Z","updated_at":"2026-11-02T14:35:23.309349Z"}],"euvd":[{"id":"EUVD-2023-50919","description":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.","status":"published","published":"2023-10-26T00:00:00Z","modified":"2025-11-04T16:10:40Z","updated_at":"2026-11-02T19:49:28.888576Z"}],"ghsa":[{"id":"GHSA-v7w5-g2hv-9797","title":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI...","description":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.","status":"published","published":"2023-10-26T06:30:25Z","modified":"2025-11-04T18:30:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:04:33.412684Z"}],"nvd":[{"id":"CVE-2023-46752","description":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.","status":"published","published":"2023-10-26T05:15:26.067Z","modified":"2026-06-17T06:31:33.483Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:08:40.004465Z"}],"osv":[{"id":"AZL-31700","title":"CVE-2023-46752 affecting package frr for versions less than 8.5.3-3","description":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.","status":"published","published":"2023-10-26T05:15:26Z","modified":"2026-04-21T04:26:28.20698Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-34692","title":"CVE-2023-46752 affecting package frr for versions less than 9.1-2","description":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.","status":"published","published":"2023-10-26T05:15:26Z","modified":"2026-04-21T04:33:14.826908Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"DEBIAN-CVE-2023-46752","description":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.","status":"published","published":"2023-10-26T05:15:26.067Z","modified":"2026-10-26T18:02:42.622403113Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"RHSA-2024:2156","title":"Red Hat Security Advisory: frr security update","status":"published","published":"2024-09-16T14:56:13Z","modified":"2026-03-18T11:33:18.12979Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RHSA-2024:2981","title":"Red Hat Security Advisory: frr security update","status":"published","published":"2024-09-16T14:56:22Z","modified":"2026-03-18T11:35:07.566188Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"RLSA-2024:2981","title":"Moderate: frr security update","description":"FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. \n\nSecurity Fix(es):\n\n* frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)\n\n* frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)\n\n* frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)\n\n* frr: mishandled malformed data leading to a crash (CVE-2023-46752)\n\n* frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.","status":"published","published":"2025-05-07T19:11:47.341314Z","modified":"2025-05-07T19:38:05.956493Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"UBUNTU-CVE-2023-46752","description":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.","status":"published","published":"2023-10-26T05:15:00Z","modified":"2026-02-04T03:17:25.750278Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:2156","title":"Moderate: frr security update","description":"FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. \n\nSecurity Fix(es):\n\n* frr: incorrect length check in bgp_capability_llgr() can lead do DoS (CVE-2023-31489)\n* frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)\n* frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)\n* frr: out of bounds read in bgp_attr_aigp_valid (CVE-2023-41359)\n* frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)\n* frr: mishandled malformed data leading to a crash (CVE-2023-46752)\n* frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)\n* frr: ahead-of-stream read of ORF header (CVE-2023-41360)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:42.652585922Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"ALSA-2024:2981","title":"Moderate: frr security update","description":"FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. \n\nSecurity Fix(es):\n\n* frr: missing length check in bgp_attr_psid_sub() can lead do DoS (CVE-2023-31490)\n* frr: processes invalid NLRIs if attribute length is zero (CVE-2023-41358)\n* frr: NULL pointer dereference in bgp_nlri_parse_flowspec() in bgpd/bgp_flowspec.c (CVE-2023-41909)\n* frr: mishandled malformed data leading to a crash (CVE-2023-46752)\n* frr: crafted BGP UPDATE message leading to a crash (CVE-2023-46753)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-05-22T00:00:00Z","modified":"2026-10-29T11:02:20.385123768Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2026-1778238289","title":"frr: Fix of 4 CVEs","description":"- CVE-2022-43681: fix bgpd crash on malformed BGP OPEN messages with insufficient data\n- CVE-2022-40318: fix out-of-bounds read in bgp_open_option_parse with extended option params\n- CVE-2023-31489: fix out-of-bounds read in BGP Long-lived Graceful-Restart capability parsing\n- CVE-2023-46752: fix bgpd crash on malformed MP_REACH_NLRI packets","status":"published","published":"2026-05-08T11:17:29Z","modified":"2026-10-21T10:45:56.316115564Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CVE-2023-46752","description":"An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash.","status":"published","published":"2023-10-26T00:00:00Z","modified":"2026-10-28T02:30:32.52296154Z","updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"DLA-3797-1","title":"frr - security update","status":"published","published":"2024-04-28T00:00:00Z","modified":"2026-03-09T01:19:39.807356Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-3865-1","title":"frr - security update","status":"published","published":"2024-09-03T00:00:00Z","modified":"2026-03-09T01:21:47.488772Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2024:13387-1","title":"frr-8.4-7.1 on GA media","description":"These are all security issues fixed in the frr-8.4-7.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:14:00.523948Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4473-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2023-46753: Fixed a crash caused from a crafted BGP UPDATE message. (bsc#1216626)\n- CVE-2023-46752: Fixed a crash caused from a mishandled malformed MP_REACH_NLRI data. (bsc#1216627)\n","status":"published","published":"2023-11-17T04:42:07Z","modified":"2026-02-04T02:48:36.517797Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4483-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2023-46752: Fixed denial of service caused by mishandling malformed MP_REACH_NLRI data (bsc#1216627).\n- CVE-2023-46753: Fixed denial of service caused by crafted BGP UPDATE messages (bsc#1216626).\n","status":"published","published":"2023-11-20T13:21:09Z","modified":"2026-02-04T03:11:01.089881Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2024:4090-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\nUpdate to frr 8.5.6 (jsc#PED-PED-11092) including fixes for:\n\n- CVE-2024-44070,CVE-2024-34088,CVE-2024-31951,CVE-2024-31950,\n  CVE-2024-31948,CVE-2024-27913,CVE-2023-47235,CVE-2023-47234,\n  CVE-2023-46753,CVE-2023-46752,CVE-2023-41909,CVE-2023-41360,\n  CVE-2023-41358,CVE-2023-38802,CVE-2023-38407,CVE-2023-38406,\n  CVE-2023-3748,CVE-2023-31490,CVE-2023-31489 and other bugfixes.\n  See https://frrouting.org/release/8.5.6/ for details.\n\nThe most recent frr 8.x series provides several new features,\nimprovements and bug fixes for various protocols and daemons,\nespecially for PIM/PIMv6/BGP and VRF support.\n\nSee https://frrouting.org/release/8.5/ for details and links.\n","status":"published","published":"2024-11-28T07:57:59Z","modified":"2026-02-04T04:12:19.142034Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-6481-1","title":"frr vulnerabilities","description":"It was discovered that FRR incorrectly handled certain malformed NLRI data.\nA remote attacker could possibly use this issue to cause FRR to crash,\nresulting in a denial of service. (CVE-2023-46752)\n\nIt was discovered that FRR incorrectly handled certain BGP UPDATE messages.\nA remote attacker could possibly use this issue to cause FRR to crash,\nresulting in a denial of service. (CVE-2023-46753)\n","status":"published","published":"2023-11-15T14:20:35Z","modified":"2026-04-27T17:02:16.040470856Z","updated_at":"2026-11-02T16:58:17.305935Z"},{"id":"USN-6807-1","title":"frr vulnerabilities","description":"It was discovered that FRR incorrectly handled certain network traffic.\nA remote attacker could possibly use this issue to cause FRR to crash,\nresulting in a denial of service. (CVE-2022-26126, CVE-2022-26127,\nCVE-2022-26128, CVE-2022-26129, CVE-2022-37032, CVE-2022-37035,\nCVE-2023-31490, CVE-2023-38406, CVE-2023-38407, CVE-2023-46752,\nCVE-2023-46753, CVE-2023-47234, CVE-2023-47235, CVE-2024-31948)\n\nBen Cartwright-Cox discovered that FRR incorrectly handled certain\nnetwork traffic. A remote attacker could possibly use this issue to cause\nFRR to crash, resulting in a denial of service. (CVE-2023-38802)\n","status":"published","published":"2024-06-05T17:19:09Z","modified":"2026-04-27T17:32:34.157755463Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}