CVE-2018-5381: High severity Quagga Quagga vulnerability
Last updated 25 August 2025
Other sources
The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN messages, in the bgppacket.c:bgpcapabilitymsgparse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI/SAFI, causing a denial of service.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
quagga/bgp-daemon (bgpd)to a version that resolves this vulnerability.Fixed in 1.2.3
Event History
Frequently Asked Questions
What is CVE-2018-5381?
CVE-2018-5381 is a vulnerability in the Quagga BGP daemon (bgpd) prior to version 1.2.3 that allows an attacker to cause a denial of service or potentially execute arbitrary code.
What is the severity of CVE-2018-5381?
CVE-2018-5381 has a severity score of 7.5 (High).
How does CVE-2018-5381 affect Quagga?
CVE-2018-5381 affects Quagga BGP daemon (bgpd) prior to version 1.2.3.
How can I fix CVE-2018-5381?
To fix CVE-2018-5381, update Quagga to version 1.2.3 or later.
Are there any references for CVE-2018-5381?
Yes, you can find more information about CVE-2018-5381 at the following references: http://savannah.nongnu.org/forum/forum.php?forum_id=9095, http://www.kb.cert.org/vuls/id/940439, https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf.