{"id":"CVE-2024-55553","aliases":["AZL-55066","AZL-55115","DEBIAN-CVE-2024-55553","DLA-4029-1","EUVD-2024-52804","GHSA-hrrq-wpmq-47mf","SUSE-SU-2025:03274-1","SUSE-SU-2025:03297-1","SUSE-SU-2025:03453-1","UBUNTU-CVE-2024-55553","USN-7230-2","USN-7230-3","openSUSE-SU-2025:14632-1"],"status":"published","title":"In FRRouting (FRR) before 10.3, it is possible for an attacker to trigger repeated RIB...","description":"In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, \u003e= 10.3.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00848,"percentile":0.58592,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-404"],"published":"2025-01-06T00:00:00Z","modified":"2026-11-06T01:13:07Z","fixes":[{"ecosystem":"Azure Linux:3","package":"frr","fixed_in":["9.1.1-3"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"frr","fixed_in":["8.5.5-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"frr","fixed_in":["10.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"frr","fixed_in":["10.2.1-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"frr","fixed_in":["7.5.1-1.1+deb11u4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"frr","fixed_in":["8.5.6-8.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"frr","fixed_in":["8.5.6-150500.4.33.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"frr","fixed_in":["8.5.6-150500.4.33.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"frr","fixed_in":["8.5.6-150500.4.33.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","fixed_in":["7.2.1-1ubuntu0.2+esm5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"frr","fixed_in":["8.1-1ubuntu1.17"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"frr","fixed_in":["8.4.4-1.1ubuntu6.8"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"frr","fixed_in":["10.2.1-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.1.1-3"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.5-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.0-0.1","10.0-0.2","10.0-1","10.0-2","10.0.1-0.1","10.1-0.1","10.1-0.2","10.1.1-0.1","10.1.1-1","10.1.1-2","10.1.1-3","10.2-1","10.2-2","10.2.1-1","10.2.1-2","10.2.1-3","10.2.1-4","10.2.1-5","10.2.1-6","10.3-1","10.3-2","10.3-3","10.3-4","10.3-5","10.3.1-1","10.3.1-2","10.3.1-3","10.3.1-4","10.4.0-1","10.4.1-1","10.4.1-2","10.4.1-3","10.5.0-1","10.5.0-2","10.5.1-1","10.5.1-2","10.5.1-3","10.5.2-1","10.5.3-1","10.6.0-1","10.6.0-2","10.6.1-1","10.6.1-2","10.6.1-3","10.7.0-1","10.7.0-2","10.7.1-1","10.7.1-2","10.7.1-3","10.7.1-4","10.7.1-5","10.7.1-6","8.4.2-1","8.4.4-1","8.4.4-1.1","8.4.4-1.1~deb12u1","8.4.4-1.1~deb12u2","9.1-0.1"]},{"source":"osv","ecosystem":"Debian:13","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.1-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.1-1.1+deb11u4"}]}],"versions":["7.5.1-1.1","7.5.1-1.1+deb11u1","7.5.1-1.1+deb11u2","7.5.1-1.1+deb11u3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-8.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.33.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.33.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.6-150500.4.33.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1-1ubuntu0.2+esm5"}]}],"versions":["6.0.2-2build2","7.2-1ubuntu1","7.2-1ubuntu2","7.2.1-1","7.2.1-1ubuntu0.1","7.2.1-1ubuntu0.2","7.2.1-1ubuntu0.2+esm1","7.2.1-1ubuntu0.2+esm2","7.2.1-1ubuntu0.2+esm3","7.2.1-1ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.17"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4","8.1-1ubuntu1.5","8.1-1ubuntu1.6","8.1-1ubuntu1.7","8.1-1ubuntu1.8","8.1-1ubuntu1.9","8.1-1ubuntu1.10","8.1-1ubuntu1.11","8.1-1ubuntu1.13","8.1-1ubuntu1.14","8.1-1ubuntu1.15","8.1-1ubuntu1.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1ubuntu6.8"}]}],"versions":["8.4.4-1.1ubuntu1","8.4.4-1.1ubuntu3","8.4.4-1.1ubuntu4","8.4.4-1.1ubuntu5","8.4.4-1.1ubuntu6","8.4.4-1.1ubuntu6.1","8.4.4-1.1ubuntu6.2","8.4.4-1.1ubuntu6.3","8.4.4-1.1ubuntu6.4","8.4.4-1.1ubuntu6.5","8.4.4-1.1ubuntu6.6","8.4.4-1.1ubuntu6.7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1-1ubuntu0.2+esm3"}]}],"versions":["6.0.2-2build2","7.2-1ubuntu1","7.2-1ubuntu2","7.2.1-1","7.2.1-1ubuntu0.1","7.2.1-1ubuntu0.2","7.2.1-1ubuntu0.2+esm1","7.2.1-1ubuntu0.2+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.13"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4","8.1-1ubuntu1.5","8.1-1ubuntu1.6","8.1-1ubuntu1.7","8.1-1ubuntu1.8","8.1-1ubuntu1.9","8.1-1ubuntu1.10","8.1-1ubuntu1.11"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1ubuntu6.3"}]}],"versions":["8.4.4-1.1ubuntu1","8.4.4-1.1ubuntu3","8.4.4-1.1ubuntu4","8.4.4-1.1ubuntu5","8.4.4-1.1ubuntu6","8.4.4-1.1ubuntu6.1","8.4.4-1.1ubuntu6.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1-1ubuntu0.2+esm5"}]}],"versions":["6.0.2-2build2","7.2-1ubuntu1","7.2-1ubuntu2","7.2.1-1","7.2.1-1ubuntu0.1","7.2.1-1ubuntu0.2","7.2.1-1ubuntu0.2+esm1","7.2.1-1ubuntu0.2+esm2","7.2.1-1ubuntu0.2+esm3","7.2.1-1ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.17"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4","8.1-1ubuntu1.5","8.1-1ubuntu1.6","8.1-1ubuntu1.7","8.1-1ubuntu1.8","8.1-1ubuntu1.9","8.1-1ubuntu1.10","8.1-1ubuntu1.11","8.1-1ubuntu1.13","8.1-1ubuntu1.14","8.1-1ubuntu1.15","8.1-1ubuntu1.16"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1ubuntu6.8"}]}],"versions":["8.4.4-1.1ubuntu1","8.4.4-1.1ubuntu3","8.4.4-1.1ubuntu4","8.4.4-1.1ubuntu5","8.4.4-1.1ubuntu6","8.4.4-1.1ubuntu6.1","8.4.4-1.1ubuntu6.2","8.4.4-1.1ubuntu6.3","8.4.4-1.1ubuntu6.4","8.4.4-1.1ubuntu6.5","8.4.4-1.1ubuntu6.6","8.4.4-1.1ubuntu6.7"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.1-1.1"}]}]}],"references":[{"url":"https://github.com/FRRouting/frr/pull/17586/commits/b0800bfdf04b4fcf48504737ebfe4ba7f05268d3","tags":["web"]},{"url":"https://frrouting.org/security/cve-2024-55553/","tags":["web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00023.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55553","tags":["web","advisory"]},{"url":"https://frrouting.org/security/cve-2024-55553"},{"url":"https://github.com/advisories/GHSA-hrrq-wpmq-47mf"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55553.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-55553","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503274-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1235237","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-55553","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503297-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503453-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-55553","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-55553","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7230-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7230-3","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-44070","tags":["report"]},{"url":"https://launchpad.net/bugs/2172964","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ZJ27Q27OUSGFPLW6WDXIRYI2Y3QJE4LU/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-55553","description":"In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, \u003e= 10.3.","status":"published","published":"2025-01-06T00:00:00Z","modified":"2025-01-23T18:03:27.294Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-404"],"updated_at":"2026-11-02T14:34:22.153872Z"}],"euvd":[{"id":"EUVD-2024-52804","description":"In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, \u003e= 10.3.","status":"published","published":"2025-01-06T00:00:00Z","modified":"2025-01-23T18:03:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:14.433513Z"}],"ghsa":[{"id":"GHSA-hrrq-wpmq-47mf","title":"In FRRouting (FRR) before 10.3, it is possible for an attacker to trigger repeated RIB...","description":"In FRRouting (FRR) before 10.3, it is possible for an attacker to trigger repeated RIB revalidation by sending approximately 500 RPKI updates, potentially leading to prolonged revalidation times and a Denial of Service (DoS) scenario.","status":"published","published":"2025-01-07T00:31:40Z","modified":"2025-01-07T00:31:49Z","updated_at":"2026-11-02T14:59:22.508847Z"}],"nvd":[{"id":"CVE-2024-55553","description":"In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, \u003e= 10.3.","status":"published","published":"2025-01-06T23:15:07.637Z","modified":"2026-06-17T08:11:13.833Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-404"],"updated_at":"2026-11-02T14:10:41.838321Z"}],"osv":[{"id":"CVE-2024-55553","description":"In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, \u003e= 10.3.","status":"published","published":"2025-01-06T00:00:00Z","modified":"2026-10-30T02:45:58.075265781Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:44.777182Z"},{"id":"DEBIAN-CVE-2024-55553","description":"In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, \u003e= 10.3.","status":"published","published":"2025-01-06T23:15:07.637Z","modified":"2026-11-02T12:03:08.050414166Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:44.429177Z"},{"id":"UBUNTU-CVE-2024-55553","description":"In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, \u003e= 10.3.","status":"published","published":"2025-01-06T23:15:00Z","modified":"2026-11-06T01:11:58.698651172Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-06T01:32:47.895286Z"},{"id":"AZL-55066","title":"CVE-2024-55553 affecting package frr for versions less than 9.1.1-3","description":"In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, \u003e= 10.3.","status":"published","published":"2025-01-06T23:15:07Z","modified":"2026-04-21T04:51:20.739742Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"AZL-55115","title":"CVE-2024-55553 affecting package frr for versions less than 8.5.5-3","description":"In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, \u003e= 10.3.","status":"published","published":"2025-01-06T23:15:07Z","modified":"2026-04-21T04:35:47.636481Z","updated_at":"2026-11-02T15:28:06.879785Z"},{"id":"DLA-4029-1","title":"frr - security update","status":"published","published":"2025-01-23T00:00:00Z","modified":"2026-03-09T01:19:28.499941Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"openSUSE-SU-2025:14632-1","title":"frr-10.2.1-1.1 on GA media","description":"These are all security issues fixed in the frr-10.2.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-01-12T00:00:00Z","modified":"2026-02-04T02:51:22.796727Z","updated_at":"2026-11-02T16:58:36.976155Z"},{"id":"SUSE-SU-2025:03274-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2024-55553: excessive resource consumption may lead to denial of service due to repeated RIB revalidation when\n  processing several RPKI updates (bsc#1235237).\n","status":"published","published":"2025-09-19T12:13:45Z","modified":"2026-03-23T04:50:30.368936Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03297-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2024-55553: excessive resource consumption may lead to denial of service due to repeated RIB revalidation when\n  processing several RPKI updates (bsc#1235237).\n","status":"published","published":"2025-09-23T08:35:15Z","modified":"2026-02-04T04:38:19.645532Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:03453-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2024-55553: excessive resource consumption may lead to denial of service due to repeated RIB revalidation when\n  processing several RPKI updates (bsc#1235237).\n","status":"published","published":"2025-10-03T10:41:01Z","modified":"2026-02-04T02:56:01.64235Z","updated_at":"2026-11-02T15:53:58.883365Z"},{"id":"USN-7230-2","title":"frr vulnerabilities","description":"Iggy Frankovic discovered that FRR incorrectly handled certain BGP\nmessages. A remote attacker could possibly use this issue to cause FRR to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n20.04 LTS. (CVE-2024-44070)\n\nIt was discovered that FRR re-validated all routes in certain instances\nwhen the internal socket's buffer size overflowed. A remote attacker could\npossibly use this issue to impact the performance of FRR, resulting in a\ndenial of service. (CVE-2024-55553)\n","status":"published","published":"2025-01-27T16:02:49Z","modified":"2026-11-06T01:00:14.290676448Z","updated_at":"2026-11-06T01:33:11.614208Z"},{"id":"USN-7230-3","title":"frr regression","description":"USN-7230-2 fixed vulnerabilities in FRR. Unfortunately, the fix for\nCVE-2024-55553 introduced a regression in RPKI support, causing FRR to stop\nprocessing RPKI updates after the first one, so routes were not revalidated\nwhen RPKI data changed. In Ubuntu 20.04 LTS, the BGP daemon also failed to\nstart when the RPKI module was enabled. This update fixes the problem.\n\nWe apologize for the inconvenience.\n\nOriginal advisory details:\n\n Iggy Frankovic discovered that FRR incorrectly handled certain BGP\n messages. A remote attacker could possibly use this issue to cause FRR to\n crash, resulting in a denial of service. This issue only affected Ubuntu\n 20.04 LTS. (CVE-2024-44070)\n\n It was discovered that FRR re-validated all routes in certain instances\n when the internal socket's buffer size overflowed. A remote attacker could\n possibly use this issue to impact the performance of FRR, resulting in a\n denial of service. (CVE-2024-55553)","status":"published","published":"2026-11-05T13:39:13Z","modified":"2026-11-06T01:13:07.568186958Z","updated_at":"2026-11-06T01:32:47.895286Z"}]}}