Summary
FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.
Security Fix(es):
* frr: denial of service via crafted FlowSpec component (CVE-2026-37457)
* frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | frr | 10.4.4-1.el10_2 |
| AlmaLinux · 10 | frr-selinux | 10.4.4-1.el10_2 |
Vulnerabilities 3
-
High 7.5
An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of …
-
High 7.5
An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) …
-
High 7.5
Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 al…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-37457
-
report
https://access.redhat.com/security/cve/CVE-2026-37459
-
report
https://bugzilla.redhat.com/2464548
-
report
https://bugzilla.redhat.com/2466513
-
advisory
https://errata.almalinux.org/10/ALSA-2026-24347.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-37460.html