Denial of Service Vulnerability in FRRouting Package - CVE-2026-37460
Summary
RLSA-2026:49527: Important: frr security, bug fix, and enhancement update. Affects frr versions < 0:8.5.3-15.el9_8.1. Fixed in 0:8.5.3-15.el9_8.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FRRouting (FRR) is an open-source software suite that provides implementations of various routing protocols, including BGP, OSPF, and RIP. It is widely used in network environments to manage TCP/IP routing. The software is designed to be flexible and efficient, making it a popular choice among network engineers. However, it has been identified that FRRouting is vulnerable to a Denial of Service (DoS) attack when processing crafted BGP UPDATE messages, which can disrupt network operations.
Vulnerability Detail
The vulnerability identified as CVE-2026-37460 allows an attacker to send specially crafted BGP UPDATE messages to the FRRouting software, leading to a Denial of Service condition. This can cause the affected routing service to crash or become unresponsive, significantly impacting network availability. The vulnerability arises from improper handling of input data in the BGP protocol implementation, which can be exploited by malicious actors to disrupt network services.
How To Fix
Minimum fixed version
0:8.5.3-15.el9_8.1
This is the first release that contains the fix.
sudo dnf update frrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, network administrators can implement access control lists (ACLs) to restrict incoming BGP UPDATE messages from untrusted sources. This can help prevent potential exploitation until the package is updated.
Conclusion
The FRRouting package has a critical vulnerability (CVE-2026-37460) that can lead to Denial of Service attacks through crafted BGP UPDATE messages. It is essential for users to update to the latest patched version to ensure network stability and security. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for frr →
FAQ
CVE-2026-37460 is a vulnerability in the FRRouting package that allows for Denial of Service attacks via crafted BGP UPDATE messages.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to service disruptions, causing the FRRouting software to crash or become unresponsive, which can affect network availability.
Yes, a patched version of the FRRouting package is available. Users should update to version 0:8.5.3-15.el9_8.1 or later.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for frr.
