USN-8376-1: FRR vulnerabilities
It was discovered that FRR incorrectly handled certain OSPF Traffic Engineering and Segment Routing TLVs. An attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2026-28532) It was discovered that FRR incorrectly handled certain BGP FlowSpec components. An attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2026-37457) It was discovered that FRR did not properly validate certain MPREACHNLRI messages. An authenticated user could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2026-37458) It was discovered that FRR incorrectly handled processing certain BGP UPDATE messages. An attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service. This issue only affected Ubuntu 25.04 and Ubuntu 25.10. (CVE-2026-37459)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 10.5.1-1ubuntu4.1 - Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 10.4.1-3ubuntu1.4 - Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 8.4.4-1.1ubuntu6.7 - Upgrade
Upgrade
ubuntu/frrto a version that resolves this vulnerability.Fixed in 8.1-1ubuntu1.16 - Upgrade
Upgrade
FRRto a version that resolves this vulnerability.Patch USN-8376-1
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Does exploiting any of these issues require authentication?
Authentication is explicitly required for CVE-2026-37458, which involves malformed MP_REACH_NLRI messages. The advisory does not state an authentication requirement for the OSPF Traffic Engineering/Segment Routing, BGP FlowSpec, or BGP UPDATE handling issues.
Which Ubuntu releases are affected by the BGP UPDATE message handling issue?
CVE-2026-37459 affects only Ubuntu 25.04 and Ubuntu 25.10. The provided advisory does not specify release scope for the other listed CVEs.