CVE-2026-37457: High severity Frrouting FRR vulnerability
Published May 1, 2026
·Updated
An off-by-one out-of-bounds write vulnerability in the bgpflowspecopdecode() function (bgpd/bgpflowspecutil.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted FlowSpec component.
Affected Software
4 affected componentsFixes available
Frrouting FRR=stable/10.0
Microsoft azl3 frr 10.5.0-3
Frrouting FRRouting=10.0
Microsoft azl3 frr 10.5.4-1
Remediation
Event History
May 1, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via Red Hat·06:01 PM
DescriptionSeverityAffected Software
Data Sourced
via NVD·06:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
May 5, 2026
Data Sourced
via Microsoft·08:03 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:03 AM
DescriptionSeverity
Updated
via Microsoft·08:03 AM
Affected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-37457?
CVE-2026-37457 is classified as a Denial of Service vulnerability.
2
How do I fix CVE-2026-37457?
To fix CVE-2026-37457, upgrade to the latest version of FRRouting that addresses this vulnerability.
3
Which versions of FRRouting are affected by CVE-2026-37457?
CVE-2026-37457 affects only the stable/10.0 version of FRRouting.
4
Can CVE-2026-37457 be exploited remotely?
Yes, CVE-2026-37457 can be exploited remotely by supplying a crafted FlowSpec component.
5
What impact does CVE-2026-37457 have on systems?
The impact of CVE-2026-37457 is a potential Denial of Service, which can disrupt the availability of affected systems.