{"id":"CVE-2026-5107","aliases":["AZL-81087","CLSA-2026-1786095204","DEBIAN-CVE-2026-5107","EUVD-2026-17060","GHSA-27p7-fq6v-hh4m","SUSE-SU-2026:2121-1","SUSE-SU-2026:21550-1","SUSE-SU-2026:22026-1","SUSE-SU-2026:2454-1","SUSE-SU-2026:2455-1","SUSE-SU-2026:2457-1","UBUNTU-CVE-2026-5107","USN-8175-1","openSUSE-SU-2026:10606-1","openSUSE-SU-2026:20682-1","openSUSE-SU-2026:20898-1"],"status":"published","title":"FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control","description":"A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00283,"percentile":0.2111,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-266","CWE-284"],"published":"2026-03-30T05:00:19Z","modified":"2026-10-28T11:16:39Z","fixes":[{"ecosystem":"Azure Linux:3","package":"frr","fixed_in":["10.5.0-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"frr","fixed_in":["8.4.4-1.1~deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"frr","fixed_in":["10.3-3+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"frr","fixed_in":["10.6.0-2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","fixed_in":["7.2.1-1ubuntu0.2+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"frr","fixed_in":["8.1-1ubuntu1.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"frr","fixed_in":["8.4.4-1.1ubuntu6.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"frr","fixed_in":["10.4.1-3ubuntu1.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"frr","fixed_in":["10.5.1-3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.0-2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.3-9.el9_6.1.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"frr-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.3-9.el9_6.1.tuxcare.els2"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1~deb12u2"}]}],"versions":["8.4.2-1","8.4.4-1","8.4.4-1.1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.3-3+deb13u1"}]}],"versions":["10.3-3"]},{"source":"osv","ecosystem":"Debian:14","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.6.0-2"}]}],"versions":["10.3-3","10.3-4","10.3-5","10.3.1-1","10.3.1-2","10.3.1-3","10.3.1-4","10.4.0-1","10.4.1-1","10.4.1-2","10.4.1-3","10.5.0-1","10.5.0-2","10.5.1-1","10.5.1-2","10.5.1-3","10.5.2-1","10.5.3-1","10.6.0-1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-160000.1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.7-150500.4.43.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.7-150500.4.43.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.7-150500.4.43.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.7-150500.4.43.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.7-150500.4.43.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.7-150500.4.43.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.7-150500.4.43.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.7-8.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.5.7-8.16.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.2.6-150700.3.10.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99.24.1-2","0.99.24.1-2ubuntu1","0.99.24.1-2ubuntu1.1","0.99.24.1-2ubuntu1.2","0.99.24.1-2ubuntu1.3","0.99.24.1-2ubuntu1.4","0.99.24.1-2ubuntu1.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.1-3","1.1.1-3ubuntu1","1.2.2-1","1.2.2-1ubuntu1","1.2.4-1","1.2.4-1ubuntu0.1~esm1","1.2.4-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"quagga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.4-4build1","1.2.4-4ubuntu0.1","1.2.4-4ubuntu0.4","1.2.4-4ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1-1ubuntu0.2+esm4"}]}],"versions":["6.0.2-2build2","7.2-1ubuntu1","7.2-1ubuntu2","7.2.1-1","7.2.1-1ubuntu0.1","7.2.1-1ubuntu0.2","7.2.1-1ubuntu0.2+esm1","7.2.1-1ubuntu0.2+esm2","7.2.1-1ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.15"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4","8.1-1ubuntu1.5","8.1-1ubuntu1.6","8.1-1ubuntu1.7","8.1-1ubuntu1.8","8.1-1ubuntu1.9","8.1-1ubuntu1.10","8.1-1ubuntu1.11","8.1-1ubuntu1.13","8.1-1ubuntu1.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1ubuntu6.6"}]}],"versions":["8.4.4-1.1ubuntu1","8.4.4-1.1ubuntu3","8.4.4-1.1ubuntu4","8.4.4-1.1ubuntu5","8.4.4-1.1ubuntu6","8.4.4-1.1ubuntu6.1","8.4.4-1.1ubuntu6.2","8.4.4-1.1ubuntu6.3","8.4.4-1.1ubuntu6.4","8.4.4-1.1ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.1-3ubuntu1.2"}]}],"versions":["10.2.1-1ubuntu3","10.3-3ubuntu2","10.4.1-3ubuntu1","10.4.1-3ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.1-1ubuntu0.2+esm4"}]}],"versions":["6.0.2-2build2","7.2-1ubuntu1","7.2-1ubuntu2","7.2.1-1","7.2.1-1ubuntu0.1","7.2.1-1ubuntu0.2","7.2.1-1ubuntu0.2+esm1","7.2.1-1ubuntu0.2+esm2","7.2.1-1ubuntu0.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1-1ubuntu1.15"}]}],"versions":["7.5.1-1.1","8.1-1","8.1-1ubuntu1","8.1-1ubuntu1.1","8.1-1ubuntu1.2","8.1-1ubuntu1.3","8.1-1ubuntu1.4","8.1-1ubuntu1.5","8.1-1ubuntu1.6","8.1-1ubuntu1.7","8.1-1ubuntu1.8","8.1-1ubuntu1.9","8.1-1ubuntu1.10","8.1-1ubuntu1.11","8.1-1ubuntu1.13","8.1-1ubuntu1.14"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.4.4-1.1ubuntu6.6"}]}],"versions":["8.4.4-1.1ubuntu1","8.4.4-1.1ubuntu3","8.4.4-1.1ubuntu4","8.4.4-1.1ubuntu5","8.4.4-1.1ubuntu6","8.4.4-1.1ubuntu6.1","8.4.4-1.1ubuntu6.2","8.4.4-1.1ubuntu6.3","8.4.4-1.1ubuntu6.4","8.4.4-1.1ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.4.1-3ubuntu1.2"}]}],"versions":["10.2.1-1ubuntu3","10.3-3ubuntu2","10.4.1-3ubuntu1","10.4.1-3ubuntu1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"frr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.1-3.1"}]}]}],"products":[{"vendor":"frrouting","product":"frr"},{"vendor":"frrouting","product":"frrouting"}],"references":[{"url":"https://vuldb.com/vuln/354132","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://vuldb.com/vuln/354132/cti","tags":["signature","permissions-required","Permissions Required","VDB Entry","report"]},{"url":"https://vuldb.com/submit/780123","tags":["third-party-advisory","Third Party Advisory","VDB Entry","advisory","report"]},{"url":"https://github.com/FRRouting/frr/pull/21098","tags":["issue-tracking","patch","Issue Tracking","Patch","fix","report"]},{"url":"https://github.com/FRRouting/frr/commit/7676cad65114aa23adde583d91d9d29e2debd045","tags":["patch","Patch","fix"]},{"url":"https://github.com/FRRouting/frr/","tags":["product","Product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5107","tags":["web","advisory"]},{"url":"https://github.com/FRRouting/frr"},{"url":"https://github.com/advisories/GHSA-27p7-fq6v-hh4m"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1786095204.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-37460","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5107.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-5107","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262121-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1252761","tags":["report"]},{"url":"https://bugzilla.suse.com/1252810","tags":["report"]},{"url":"https://bugzilla.suse.com/1252811","tags":["report"]},{"url":"https://bugzilla.suse.com/1252812","tags":["report"]},{"url":"https://bugzilla.suse.com/1252813","tags":["report"]},{"url":"https://bugzilla.suse.com/1252829","tags":["report"]},{"url":"https://bugzilla.suse.com/1252833","tags":["report"]},{"url":"https://bugzilla.suse.com/1252835","tags":["report"]},{"url":"https://bugzilla.suse.com/1252838","tags":["report"]},{"url":"https://bugzilla.suse.com/1261013","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61100","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61101","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61104","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-61107","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5107","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202621550-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622026-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1263859","tags":["report"]},{"url":"https://bugzilla.suse.com/1263863","tags":["report"]},{"url":"https://bugzilla.suse.com/1263974","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-28532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-37458","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262454-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262455-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262457-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-5107","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5107","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8175-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-5107","title":"FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control","description":"A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-03-30T05:00:19.025Z","modified":"2026-03-30T16:02:10.336Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","level":"low","assessor":"cna"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C","level":"medium","assessor":"cna"},{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C","level":"medium","assessor":"cna"},{"version":"2.0","score":3.6,"vector":"AV:N/AC:H/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C","assessor":"cna"}],"cwes":["CWE-284","CWE-266"],"updated_at":"2026-11-02T13:39:39.001586Z"}],"euvd":[{"id":"EUVD-2026-17060","description":"A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-03-30T05:00:19Z","modified":"2026-03-30T16:02:10Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","level":"low"}],"updated_at":"2026-11-02T19:25:25.878486Z"}],"ghsa":[{"id":"GHSA-27p7-fq6v-hh4m","title":"A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function...","description":"A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-03-30T06:30:26Z","modified":"2026-03-30T06:30:31Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T15:06:55.220248Z"}],"nvd":[{"id":"CVE-2026-5107","description":"A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-03-30T06:16:05.51Z","modified":"2026-06-17T10:58:26.947Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":3.6,"vector":"AV:N/AC:H/Au:S/C:N/I:P/A:P","level":"low","assessor":"secondary"}],"cwes":["CWE-266","CWE-284"],"updated_at":"2026-11-02T14:12:12.261218Z"}],"osv":[{"id":"CVE-2026-5107","title":"FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control","description":"A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-03-30T05:00:19.025Z","modified":"2026-10-28T11:16:39.779791536Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X","level":"low"}],"cwes":["CWE-266","CWE-284"],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"DEBIAN-CVE-2026-5107","description":"A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-03-30T06:16:05.51Z","modified":"2026-10-01T03:03:24.735341695Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:56.877408Z"},{"id":"UBUNTU-CVE-2026-5107","description":"A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-03-30T06:16:00Z","modified":"2026-05-30T17:15:05.446982158Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T16:56:33.391918Z"},{"id":"AZL-81087","title":"CVE-2026-5107 affecting package frr for versions less than 10.5.0-2","description":"A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.","status":"published","published":"2026-03-30T06:16:05Z","modified":"2026-08-28T17:56:48.911648Z","updated_at":"2026-11-02T15:28:10.017343Z"},{"id":"CLSA-2026-1786095204","title":"frr: Fix of CVE-2026-37460","description":"- CVE-2026-37460: fix missing input validation in the rfapiRibBi2Ri()\n  RFP-option parser (bgpd/rfapi/rfapi_rib.c) allowing a bgpd DoS via a\n  crafted BGP UPDATE with a short or zero-length VNC RFPOPTION subTLV.\n  Scoped to the rfapi_rib.c hunk of upstream 7676cad6 to match NVD, which\n  defines this CVE as rfapiRibBi2Ri() only; the same commit's bgp_evpn.c\n  and bgp_evpn_mh.c hunks belong to CVE-2026-5107 and are not included","status":"published","published":"2026-08-07T09:33:34Z","modified":"2026-10-26T09:31:26.050805981Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"openSUSE-SU-2026:10606-1","title":"frr-10.5.1-3.1 on GA media","description":"These are all security issues fixed in the frr-10.5.1-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-23T00:00:00Z","modified":"2026-04-24T08:16:07.48797Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:20682-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\nSecurity issues:\n\n- CVE-2025-61099: NULL Pointer Dereference in FRRouting (bsc#1252838).\n- CVE-2025-61100: NULL Pointer Dereference in FRRouting (bsc#1252829).\n- CVE-2025-61101: NULL Pointer Dereference in FRRouting (bsc#1252833).\n- CVE-2025-61102: NULL Pointer Dereference in FRRouting (bsc#1252835).\n- CVE-2025-61103: NULL pointer dereference in show_vty_ext_link_lan_adj_sid() in ospf_ext.c (bsc#1252810).\n- CVE-2025-61104: NULL pointer dereference in show_vty_unknown_tlv() in ospf_ext.c (bsc#1252811).\n- CVE-2025-61105: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the\n  show_vty_link_info function at ospf_ext.c (bsc#1252761).\n- CVE-2025-61106: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252812).\n- CVE-2025-61107: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252813).\n- CVE-2026-5107: A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function\n  process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to\n  improper a (bsc#1261013).\n","status":"published","published":"2026-05-05T14:33:42Z","modified":"2026-05-07T08:46:32.438496Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:20898-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).\n- CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).\n- CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).\n- CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).\n","status":"published","published":"2026-06-03T09:46:09Z","modified":"2026-06-06T18:24:32.122396762Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:2121-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2025-61099: NULL Pointer Dereference in FRRouting (bsc#1252838).\n- CVE-2025-61100: NULL Pointer Dereference in FRRouting (bsc#1252829).\n- CVE-2025-61101: NULL Pointer Dereference in FRRouting (bsc#1252833).\n- CVE-2025-61102: NULL Pointer Dereference in FRRouting (bsc#1252835).\n- CVE-2025-61103: NULL pointer dereference in show_vty_ext_link_lan_adj_sid() in ospf_ext.c (bsc#1252810).\n- CVE-2025-61104: NULL pointer dereference in show_vty_unknown_tlv() in ospf_ext.c (bsc#1252811).\n- CVE-2025-61105: NULL pointer dereference in show_vty_link_info() in ospf_ext.c (bsc#1252761).\n- CVE-2025-61106: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252812).\n- CVE-2025-61107: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252813).\n- CVE-2026-5107: Improper access controls via bgpd EVPN and ENCAP/VNC packet parsing (bsc#1261013).\n","status":"withdrawn","published":"2026-05-29T15:36:29Z","modified":"2026-07-13T14:00:33.988081808Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:21550-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\nSecurity issues:\n\n- CVE-2025-61099: NULL Pointer Dereference in FRRouting (bsc#1252838).\n- CVE-2025-61100: NULL Pointer Dereference in FRRouting (bsc#1252829).\n- CVE-2025-61101: NULL Pointer Dereference in FRRouting (bsc#1252833).\n- CVE-2025-61102: NULL Pointer Dereference in FRRouting (bsc#1252835).\n- CVE-2025-61103: NULL pointer dereference in show_vty_ext_link_lan_adj_sid() in ospf_ext.c (bsc#1252810).\n- CVE-2025-61104: NULL pointer dereference in show_vty_unknown_tlv() in ospf_ext.c (bsc#1252811).\n- CVE-2025-61105: FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the\n  show_vty_link_info function at ospf_ext.c (bsc#1252761).\n- CVE-2025-61106: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252812).\n- CVE-2025-61107: NULL pointer dereference in show_vty_ext_pref_pref_sid() in ospf_ext.c (bsc#1252813).\n- CVE-2026-5107: A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function\n  process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to\n  improper a (bsc#1261013).\n","status":"published","published":"2026-05-05T14:38:46Z","modified":"2026-05-12T18:26:30.114247Z","updated_at":"2026-11-02T15:54:02.312556Z"},{"id":"SUSE-SU-2026:22026-1","title":"Security update for frr","description":"This update for frr fixes the following issues:\n\n- CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).\n- CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).\n- CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).\n- CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).\n","status":"published","published":"2026-06-03T09:45:24Z","modified":"2026-06-09T18:24:28.421755542Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2454-1","title":"Security update for frr","description":"This update for frr fixes the following issues\n\nUpdate to frr 8.5.7:\n\n- CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).\n- CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).\n- CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).\n- CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).\n  DoS via a crafted UPDATE message (bsc#1263974).\n","status":"published","published":"2026-06-18T14:02:41Z","modified":"2026-06-19T08:15:05.714563473Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2455-1","title":"Security update for frr","description":"This update for frr fixes the following issues\n\n- CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).\n- CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).\n- CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).\n- CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).\n","status":"published","published":"2026-06-18T14:02:48Z","modified":"2026-06-19T08:15:07.138593658Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"SUSE-SU-2026:2457-1","title":"Security update for frr","description":"This update for frr fixes the following issue:\n\n- CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).\n- CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).\n- CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).\n- CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).\n","status":"published","published":"2026-06-18T15:54:17Z","modified":"2026-06-19T08:15:07.126530908Z","updated_at":"2026-11-02T15:54:04.519245Z"},{"id":"USN-8175-1","title":"frr vulnerability","description":"It was discovered that FRR did not correctly handle certain network\nrequests. A remote attacker could possibly use this issue to gain\nunauthorized access to resources.","status":"published","published":"2026-04-15T03:06:36Z","modified":"2026-06-16T00:59:22.852222745Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}