CVE-2026-37459 describes an integer underflow vulnerability in FRRouting (FRR) versions 10.0 to 10.6. This vulnerability can be triggered by an attacker supplying a crafted BGP UPDATE message, resulting in a denial of service condition. The vulnerability is tracked under CWE-400 (Uncontrolled Resource Consumption) and CWE-191 (Integer Underflow). Red Hat has issued security advisories and updated FRRouting packages (notably version 10.4.4-1.el10_2 and later) to fix this issue. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability (denial of service).

Successful exploitation of this vulnerability allows remote attackers to cause a denial of service on affected FRRouting instances by sending crafted BGP UPDATE messages. This disrupts routing protocol operations, potentially impacting network availability. There is no impact on confidentiality or integrity reported.

Red Hat has released official security updates that fix this vulnerability. Users of Red Hat Enterprise Linux 10 with FRRouting versions 10.0 through 10.6 should apply the available patches, such as frr-10.4.4-1.el10_2 and later, as detailed in Red Hat advisories RHSA-2026:24347 and RHSA-2026:24370. Applying these updates will remediate the vulnerability. No additional mitigation steps are indicated by the vendor.