CVE-2026-37458
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
May 4, 2026
CISA due date
—
The record
Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | frr | 0 | 10.6.1-1.1 |
Related vulnerabilities
- CVE-2026-37459 An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to… Also affects frr
- CVE-2026-37457 An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function… Also affects frr
- CVE-2026-28532 FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic… Also affects frr
- CVE-2026-5107 A vulnerability has been found in FRRouting FRR up to 10.5.1. Also affects frr
- CVE-2025-61104 FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer… Also affects frr
- CVE-2025-61100 FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer… Also affects frr
- CVE-2025-61099 FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer… Also affects frr
- CVE-2024-55553 In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total… Also affects frr