{"id":"CVE-2024-31949","aliases":["DEBIAN-CVE-2024-31949","DLA-3797-1","DLA-3865-1","EUVD-2024-29807","GHSA-f3q5-vrp5-crqj","UBUNTU-CVE-2024-31949"],"status":"published","title":"In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a...","description":"In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.007,"percentile":0.53515,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-835"],"published":"2024-04-07T00:00:00Z","modified":"2026-11-02T12:02:18Z","fixes":[{"ecosystem":"Debian:13","package":"frr","fixed_in":["10.0.1-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"frr","fixed_in":["10.0.1-0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0-0.1","10.0-0.2","10.0-1","10.0-2","10.0.1-0.1","10.1-0.1","10.1-0.2","10.1.1-0.1","10.1.1-1","10.1.1-2","10.1.1-3","10.2-1","10.2-2","10.2.1-1","10.2.1-2","10.2.1-3","10.2.1-4","10.2.1-5","10.2.1-6","10.3-1","10.3-2","10.3-3","10.3-4","10.3-5","10.3.1-1","10.3.1-2","10.3.1-3","10.3.1-4","10.4.0-1","10.4.1-1","10.4.1-2","10.4.1-3","10.5.0-1","10.5.0-2","10.5.1-1","10.5.1-2","10.5.1-3","10.5.2-1","10.5.3-1","10.6.0-1","10.6.0-2","10.6.1-1","10.6.1-2","10.6.1-3","10.7.0-1","10.7.0-2","10.7.1-1","10.7.1-2","10.7.1-3","10.7.1-4","10.7.1-5","10.7.1-6","8.4.2-1","8.4.4-1","8.4.4-1.1","8.4.4-1.1~deb12u1","8.4.4-1.1~deb12u2","9.1-0.1"]},{"source":"osv","ecosystem":"Debian:13","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.1-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.1-0.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-1.1+deb10u2"}]}],"versions":["6.0.2-2","6.0.2-2+deb10u1","6.0.2-2+deb10u2","7.2-1","7.2.1-1","7.3.1-1","7.4-1","7.4-1.1","7.4-2","7.5-1","7.5.1-1","7.5.1-1.1","7.5.1-1.1+deb10u1"],"bundled":14},{"source":"osv","ecosystem":"Debian:11","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-1.1+deb11u3"}]}],"versions":["7.5.1-1.1","7.5.1-1.1+deb11u1","7.5.1-1.1+deb11u2"],"bundled":16}],"products":[{"vendor":"frrouting","product":"frrouting"}],"references":[{"url":"https://github.com/FRRouting/frr/pull/15640","tags":["x_transferred","Issue Tracking","fix"]},{"url":"https://github.com/FRRouting/frr/pull/15640/commits/30a332dad86fafd2b0b6c61d23de59ed969a219b","tags":["x_transferred","Patch","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html","tags":["mailing-list","x_transferred","Mailing List","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/09/msg00007.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31949","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-f3q5-vrp5-crqj"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31949.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-31949","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-31949","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31949","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-31949","description":"In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing.","status":"published","published":"2024-04-07T00:00:00Z","modified":"2025-11-04T16:12:08.694Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:14.649724Z"}],"euvd":[{"id":"EUVD-2024-29807","description":"In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing.","status":"published","published":"2024-04-07T00:00:00Z","modified":"2025-11-04T16:12:08Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:49:28.888576Z"}],"ghsa":[{"id":"GHSA-f3q5-vrp5-crqj","title":"In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a...","description":"In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing.","status":"published","published":"2024-04-07T21:30:28Z","modified":"2025-11-04T18:30:47Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T15:04:33.412684Z"}],"nvd":[{"id":"CVE-2024-31949","description":"In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing.","status":"published","published":"2024-04-07T21:15:07.48Z","modified":"2026-06-17T07:28:59.387Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-835"],"updated_at":"2026-11-02T14:09:48.152273Z"}],"osv":[{"id":"CVE-2024-31949","description":"In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing.","status":"published","published":"2024-04-07T00:00:00Z","modified":"2026-10-28T02:30:25.321782781Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"DEBIAN-CVE-2024-31949","description":"In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing.","status":"published","published":"2024-04-07T21:15:07.48Z","modified":"2026-11-02T12:02:18.787008751Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"UBUNTU-CVE-2024-31949","description":"In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointer not advancing.","status":"withdrawn","published":"2024-04-07T21:15:00Z","modified":"2025-07-16T07:47:13.115031Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"DLA-3797-1","title":"frr - security update","status":"published","published":"2024-04-28T00:00:00Z","modified":"2026-03-09T01:19:39.807356Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DLA-3865-1","title":"frr - security update","status":"published","published":"2024-09-03T00:00:00Z","modified":"2026-03-09T01:21:47.488772Z","updated_at":"2026-11-02T15:46:12.203458Z"}]}}