CVE-2026-5107
Medium · 4.2CVSS
4.2
EPSS
0.4%
Published
Mar 30, 2026
CISA due date
—
The record
A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | frr | 0 | 10.5.1-3.1 |
Related vulnerabilities
- CVE-2026-37459 An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to… Also affects frr
- CVE-2026-37458 Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to… Also affects frr
- CVE-2026-37457 An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function… Also affects frr
- CVE-2026-28532 FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic… Also affects frr
- CVE-2025-61104 FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer… Also affects frr
- CVE-2025-61100 FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer… Also affects frr
- CVE-2025-61099 FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer… Also affects frr
- CVE-2024-55553 In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total… Also affects frr