CVE-2026-37458: Input Validation
Missing input validation in the MPREACHNLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Service (DoS) via supplying a crafted UPDATE message.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 8.1-1ubuntu1.16 - Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 8.4.4-1.1ubuntu6.7 - Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 10.4.1-3ubuntu1.4 - Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 10.5.1-1ubuntu4.1 - Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 8.4.4-1.1~deb12u2Fixed in 10.3-3+deb13u1Fixed in 10.7.1-7 - Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 8.4.4-1.1~deb12u2 - Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 10.3-3+deb13u1 - Upgrade
Upgrade
debian/frrto a version that resolves this vulnerability.Fixed in 10.6.0-2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-37458?
CVE-2026-37458 has a medium severity rating of 6.5 according to the CVSS 3.1 metrics.
What is CVE-2026-37458 about?
CVE-2026-37458 involves missing input validation in the MP_REACH_NLRI component of FRRouting that can lead to a Denial of Service (DoS) when exploited.
Who can exploit CVE-2026-37458?
Authenticated attackers can exploit CVE-2026-37458 by sending a specially crafted UPDATE message.
How do I fix CVE-2026-37458?
To fix CVE-2026-37458, apply the available patch provided in the FRRouting repository.
What impact does CVE-2026-37458 have on systems?
The impact of CVE-2026-37458 includes the potential for Denial of Service (DoS), affecting system availability.