Critical Security Update for FRRouting Package: Denial of Service Vulnerabilities
Summary
ALSA-2026:24347: Important: frr security update. Affects frr versions < 10.4.4-1.el10_2. Fixed in 10.4.4-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FRRouting (frr) is an open-source software suite that provides implementations of various routing protocols including BGP, OSPF, and RIP. It is designed to facilitate the management of TCP/IP-based routing protocols, making it essential for network operations. The package is widely used in both enterprise and academic environments for its robust features and flexibility. However, recent vulnerabilities have been identified that could potentially compromise the stability of systems utilizing this package.
Vulnerability Detail
The vulnerabilities identified in FRRouting are classified as denial of service (DoS) threats. Specifically, CVE-2026-37457 allows an attacker to exploit crafted FlowSpec components, while CVE-2026-37459 involves crafted BGP UPDATE messages. Both vulnerabilities can lead to service interruptions, making the affected systems unresponsive. These issues arise from improper handling of specific protocol messages, which can be triggered by malicious actors to disrupt network services.
How To Fix
Minimum fixed version
10.4.4-1.el10_2
This is the first release that contains the fix.
sudo dnf update frrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the FRRouting service by implementing firewall rules to limit incoming traffic to trusted sources only. This can help mitigate the risk of exploitation until the package is updated. Example command to block all incoming traffic except from a specific IP:
sudo iptables -A INPUT -s <trusted_ip> -j ACCEPT; sudo iptables -A INPUT -j DROP'.
Conclusion
The recent vulnerabilities in the FRRouting package pose significant risks to network stability through potential denial of service attacks. It is crucial for users to update to the latest patched version to safeguard their systems. Implementing temporary workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for frr →
FAQ
FRRouting is an open-source software suite that implements various routing protocols for managing TCP/IP networks.
The vulnerabilities include denial of service attacks via crafted FlowSpec components and BGP UPDATE messages, identified as CVE-2026-37457 and CVE-2026-37459.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Implement firewall rules to restrict access to the FRRouting service as a temporary workaround until you can apply the update.
More details can be found on the CVE pages for CVE-2026-37457 and CVE-2026-37459, which provide insights into the impact and technical aspects of the vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for frr.
