{"id":"CVE-2024-31951","aliases":["AZL-39815","DEBIAN-CVE-2024-31951","EUVD-2024-29809","GHSA-h4c3-x7vv-8q28","SUSE-SU-2024:1971-1","SUSE-SU-2024:4090-1","UBUNTU-CVE-2024-31951","USN-6794-1","openSUSE-SU-2024:14038-1"],"status":"published","title":"In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer...","description":"In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.0054,"percentile":0.45941,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120"],"published":"2024-04-07T00:00:00Z","modified":"2026-11-02T12:00:12Z","fixes":[{"ecosystem":"Azure Linux:2","package":"frr","fixed_in":["8.5.5-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"frr","fixed_in":["8.4.4-1.1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"frr","fixed_in":["10.3-3+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"frr","fixed_in":["10.0.1-0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"frr","fixed_in":["8.1-1ubuntu1.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"frr","fixed_in":["8.4.4-1.1ubuntu6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.5-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1~deb12u2"}]}],"versions":["8.4.2-1","8.4.4-1","8.4.4-1.1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3-3+deb13u1"}]}],"versions":["10.3-3"]},{"source":"osv","ecosystem":"Debian:14","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.0.1-0.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-150500.4.23.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.30.1"}]}],"bundled":19},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.10"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4","8.1-1ubuntu1.5","8.1-1ubuntu1.6","8.1-1ubuntu1.7","8.1-1ubuntu1.8","8.1-1ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1ubuntu6.1"}]}],"versions":["8.4.4-1.1ubuntu1","8.4.4-1.1ubuntu3","8.4.4-1.1ubuntu4","8.4.4-1.1ubuntu5","8.4.4-1.1ubuntu6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.10"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4","8.1-1ubuntu1.5","8.1-1ubuntu1.6","8.1-1ubuntu1.7","8.1-1ubuntu1.8","8.1-1ubuntu1.9"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1ubuntu6.1"}]}],"versions":["8.4.4-1.1ubuntu1","8.4.4-1.1ubuntu3","8.4.4-1.1ubuntu4","8.4.4-1.1ubuntu5","8.4.4-1.1ubuntu6"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4-12.1"}]}],"bundled":3}],"products":[{"vendor":"frrouting","product":"frrouting"}],"references":[{"url":"https://github.com/FRRouting/frr/pull/15674/","tags":["x_transferred","Issue Tracking","web"]},{"url":"https://github.com/FRRouting/frr/pull/15674/commits/344fb4be2bc27316c74b17003c05ea40be395836","tags":["x_transferred","Patch","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-31951","tags":["web","advisory"]},{"url":"https://github.com/FRRouting/frr/pull/15674"},{"url":"https://github.com/advisories/GHSA-h4c3-x7vv-8q28"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/31xxx/CVE-2024-31951.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-31951","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241971-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1222526","tags":["report"]},{"url":"https://bugzilla.suse.com/1222528","tags":["report"]},{"url":"https://bugzilla.suse.com/1223786","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34088","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20244090-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-31490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38802","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-41909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-46753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47234","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47235","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-31948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44070","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-31951","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-31951","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6794-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-31948","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-31950","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-34088","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-31951","description":"In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).","status":"published","published":"2024-04-07T00:00:00Z","modified":"2024-11-04T16:35:33.664Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:34:14.308905Z"}],"euvd":[{"id":"EUVD-2024-29809","description":"In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).","status":"published","published":"2024-04-07T00:00:00Z","modified":"2024-11-04T16:35:33Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T00:05:11.811805Z"}],"ghsa":[{"id":"GHSA-h4c3-x7vv-8q28","title":"In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer...","description":"In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).","status":"published","published":"2024-04-07T21:30:28Z","modified":"2024-11-04T18:32:24Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:58:43.210342Z"}],"nvd":[{"id":"CVE-2024-31951","description":"In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).","status":"published","published":"2024-04-07T21:15:07.6Z","modified":"2026-06-17T07:28:59.69Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:09:48.152273Z"}],"osv":[{"id":"CVE-2024-31951","description":"In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).","status":"published","published":"2024-04-07T00:00:00Z","modified":"2026-10-28T02:31:10.115277985Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"DEBIAN-CVE-2024-31951","description":"In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).","status":"published","published":"2024-04-07T21:15:07.6Z","modified":"2026-11-02T12:00:12.777062047Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"UBUNTU-CVE-2024-31951","description":"In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).","status":"published","published":"2024-04-07T21:15:00Z","modified":"2026-02-04T02:31:40.874109Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"AZL-39815","title":"CVE-2024-31951 affecting package frr for versions less than 8.5.5-1","description":"In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read Segment Routing Adjacency SID subTLVs (lengths are not validated).","status":"published","published":"2024-04-07T21:15:07Z","modified":"2026-04-21T04:28:49.353847Z","updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"openSUSE-SU-2024:14038-1","title":"frr-8.4-12.1 on GA media","description":"These are all security issues fixed in the frr-8.4-12.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:18:05.832649Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"SUSE-SU-2024:1971-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2024-34088: Fixed null pointer via get_edge() function can trigger a denial of service (bsc#1223786).\n- CVE-2024-31951: Fixed buffer overflow in ospf_te_parse_ext_link (bsc#1222528).\n- CVE-2024-31950: Fixed buffer overflow and daemon crash in ospf_te_parse_ri (bsc#1222526).\n","status":"published","published":"2024-06-10T18:05:22Z","modified":"2026-02-04T03:09:26.882356Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:4090-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\nUpdate to frr 8.5.6 (jsc#PED-PED-11092) including fixes for:\n\n- CVE-2024-44070,CVE-2024-34088,CVE-2024-31951,CVE-2024-31950,\n  CVE-2024-31948,CVE-2024-27913,CVE-2023-47235,CVE-2023-47234,\n  CVE-2023-46753,CVE-2023-46752,CVE-2023-41909,CVE-2023-41360,\n  CVE-2023-41358,CVE-2023-38802,CVE-2023-38407,CVE-2023-38406,\n  CVE-2023-3748,CVE-2023-31490,CVE-2023-31489 and other bugfixes.\n  See https://frrouting.org/release/8.5.6/ for details.\n\nThe most recent frr 8.x series provides several new features,\nimprovements and bug fixes for various protocols and daemons,\nespecially for PIM/PIMv6/BGP and VRF support.\n\nSee https://frrouting.org/release/8.5/ for details and links.\n","status":"published","published":"2024-11-28T07:57:59Z","modified":"2026-02-04T04:12:19.142034Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"USN-6794-1","title":"frr vulnerabilities","description":"It was discovered that FRR incorrectly handled certain malformed BGP and\nOSPF packets. A remote attacker could use this issue to cause FRR to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n","status":"published","published":"2024-05-28T15:29:21Z","modified":"2026-02-10T04:43:49Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}