Threat Intelligence Database

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

CVE-2026-37458 is a vulnerability in the MP_REACH_NLRI component of FRRouting versions stable/10.0 through stable/10.6. It involves missing input validation that allows authenticated attackers to cause a Denial of Service (DoS) by sending a crafted UPDATE message. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. There is no confirmed patch or official remediation available at this time, and no known exploits in the wild have been reported.

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

CVE-2026-5107 is a vulnerability in FRRouting (FRR) versions up to 10.5.1 affecting the EVPN Type-2 Route Handler component. It involves improper access controls in the process_type2_route function, which can be triggered remotely. The vulnerability has a low CVSS score of 2.3, indicating low severity. Exploitation complexity is high and exploitability is difficult. A patch identified by commit 7676cad65114aa23adde583d91d9d29e2debd045 is recommended to fix the issue.

FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted LSA Update packet.

HighVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-61107

FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet.

HighVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-61106

FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_unknown_tlv function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet.

HighVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2025-61104

FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_lan_adj_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet.

HighVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2025-61103

FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_adj_sid function at ospf_ext.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted OSPF packet.

HighVulnerabilityGermanyFranceUnited Kingdom+2#cve#cve-2025-61102