Critical Denial of Service Vulnerability in FRRouting (frr10) - CVE-2026-37457 and CVE-2026-37459
Summary
RLSA-2026:24370: Important: frr10 security update. Affects frr10 versions < 0:10.4.3-3.el9_8. Fixed in 0:10.4.3-3.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FRRouting (frr10) is an open-source software suite that provides implementations of various routing protocols, including BGP4, OSPF, and RIP. It is designed to manage TCP/IP-based routing protocols in a multi-server and multi-threaded environment, addressing the complexities of modern Internet routing. As a fork of Quagga, FRRouting is widely used in networking applications but is susceptible to specific vulnerabilities that can lead to service disruptions.
Vulnerability Detail
The vulnerabilities identified as CVE-2026-37457 and CVE-2026-37459 in FRRouting allow for denial of service attacks. CVE-2026-37457 arises from a crafted FlowSpec component, while CVE-2026-37459 is triggered by a specially crafted BGP UPDATE message. Both vulnerabilities can cause the affected service to become unresponsive, potentially leading to significant network outages and disruptions. The CVSS score for these vulnerabilities is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
0:10.4.3-3.el9_8
This is the first release that contains the fix.
sudo dnf update frr10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can mitigate the risk by implementing strict input validation on incoming FlowSpec components and BGP UPDATE messages, although this may not fully prevent the denial of service attacks.
Conclusion
The vulnerabilities in FRRouting (frr10) pose significant risks to network stability and security. It is crucial to update to the latest patched version to mitigate these risks and ensure the integrity of your routing protocols. Regular monitoring and proactive measures can help safeguard against potential threats.
See every vulnerability recorded for frr10 →
FAQ
The main vulnerabilities are CVE-2026-37457, which involves denial of service via crafted FlowSpec components, and CVE-2026-37459, which involves denial of service via crafted BGP UPDATE messages.
These vulnerabilities have a CVSS score of 7.5, indicating a high severity level that could lead to significant service disruptions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without requiring any signup.
You should update the frr10 package to the latest patched version using 'sudo dnf update frr10' to mitigate the vulnerabilities.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for frr10.
