Critical Denial of Service Vulnerability in FRRouting Package
Summary
RLSA-2026:49511: Important: frr security update. Affects frr versions < 0:7.5.1-25.el8_10. Fixed in 0:7.5.1-25.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FRRouting (frr) is an open-source software suite that provides implementations of various routing protocols for TCP/IP networks. It supports protocols such as BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP, and BFD. This software is widely used in network infrastructure to manage routing and ensure efficient data flow. However, a critical vulnerability has been identified that could lead to a Denial of Service (DoS) when a crafted BGP UPDATE message is processed.
Vulnerability Detail
The vulnerability, identified as CVE-2026-37460, allows an attacker to send a specially crafted BGP UPDATE message to the FRRouting software, which can cause the application to crash or become unresponsive. This Denial of Service attack can disrupt network operations, leading to potential downtime and loss of connectivity. The CVSS score for this vulnerability is 7.5, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
0:7.5.1-25.el8_10
This is the first release that contains the fix.
sudo dnf update frrTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, network administrators may consider filtering incoming BGP UPDATE messages to prevent malicious payloads from reaching the FRRouting software. However, this is not a permanent solution and should not replace applying the necessary updates.
Conclusion
The identified vulnerability in the FRRouting package poses a significant risk to network operations due to its potential for Denial of Service attacks. It is crucial for users to update their software to the latest patched version to mitigate this risk. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of open-source software.
See every vulnerability recorded for frr →
FAQ
CVE-2026-37460 is a vulnerability in the FRRouting software that allows for Denial of Service attacks via crafted BGP UPDATE messages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploiting this vulnerability can lead to a Denial of Service, causing the FRRouting software to crash and potentially disrupting network services.
Yes, a patched version of the FRRouting package is available. Users should update to version 0:7.5.1-25.el8_10 or later.
The CVSS score for this vulnerability is 7.5, indicating a high severity level that requires prompt action.
Related vulnerabilities
Recent vulnerabilities recorded for frr.
