CVE-2026-5107: FRRouting FRR EVPN Type-2 Route bgp_evpn.c process_type2_route access control
A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function processtype2route of the file bgpd/bgpevpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.
Other sources
FRRouting FRR EVPN Type-2 Route bgpevpn.c processtype2route access control
— Microsoft
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5107?
CVE-2026-5107 is considered a high severity vulnerability in FRRouting FRR versions up to 10.5.1.
How do I fix CVE-2026-5107?
To fix CVE-2026-5107, upgrade to FRRouting FRR version 10.5.2 or later.
What components are affected by CVE-2026-5107?
CVE-2026-5107 affects the EVPN Type-2 Route Handler in FRRouting FRR.
What type of vulnerability is CVE-2026-5107?
CVE-2026-5107 is a vulnerability that leads to improper access control in the process_type2_route function.
Which versions of FRRouting FRR are vulnerable to CVE-2026-5107?
FRRouting FRR versions up to and including 10.5.1 are vulnerable to CVE-2026-5107.