# CVE-2017-5495: Quagga and FRRouting unbounded memory allocation in vty CLI

Source: https://junglewise.ai/threats/cve-2017-5495-quagga-and-frrouting-unbounded-memory-allocation-in-vty-cli  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-24. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5495 · Severity: high · CVSS 7.5 · Published 2017-01-24

Quagga is a software suite used to manage network routing protocols like BGP and OSPF. A vulnerability in its management interface allows an unauthenticated attacker to crash the routing service or the entire server by sending specially crafted, long text strings. This can lead to a complete loss of network connectivity and service availability for the affected infrastructure.

Technologies: [Frrouting](https://junglewise.ai/threats/technologies/frrouting). Vendors: [Frrouting](https://junglewise.ai/threats/vendors/frrouting).

## Quick answers

**Is CVE-2017-5495 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5495 being exploited in the wild.

**How severe is CVE-2017-5495?** High severity, with a CVSS score of 7.5, published 24 January 2017.

**Which products and versions are affected?** Frrouting Prior to 2017-01-10.

**Is there a fix for CVE-2017-5495?** A patch was published on 2017-01-10: FRRouting fix merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5495 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2017-5495?** Check whether you run Frrouting or Quagga at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the 'vty' telnet CLI component of Quagga and early versions of FRRouting due to improper restriction of memory buffer operations (CWE-119). The input buffer for the telnet interface is designed to grow automatically without a hard limit until a newline character is received. An unauthenticated remote attacker with network access to the TCP ports used by Quagga daemons can send an extremely long string without a newline, causing the process to allocate all available system memory. This results in the daemon being killed by the OOM (Out of Memory) killer or a total system crash. The issue is resolved in Quagga 1.1.1 and FRR 2017-01-10 by implementing a 4096-byte cap on the vty buffer.

## Affected products

- Quagga Quagga 0.93 through 1.1.0
- FRRouting FRRouting (FRR) Protocol Suite Prior to 2017-01-10

## Timeline

- 2017-01-10: patched: FRRouting fix merged
- 2017-01-24: disclosed: Public disclosure of CVE-2017-5495
- 2017-01-24: advisory: NVD published date

## References

- [http://rhn.redhat.com/errata/RHSA-2017-0794.html](http://rhn.redhat.com/errata/RHSA-2017-0794.html)
- [http://savannah.nongnu.org/forum/forum.php?forum_id=8783](http://savannah.nongnu.org/forum/forum.php?forum_id=8783)
- [http://www.securityfocus.com/bid/95745](http://www.securityfocus.com/bid/95745)
- [http://www.securitytracker.com/id/1037688](http://www.securitytracker.com/id/1037688)
- [https://github.com/freerangerouting/frr/pull/63](https://github.com/freerangerouting/frr/pull/63)
- [https://lists.quagga.net/pipermail/quagga-dev/2017-January/016586.html](https://lists.quagga.net/pipermail/quagga-dev/2017-January/016586.html)

## Related threats

- [FRRouting OSPFv3 spoofed packet acceptance](https://junglewise.ai/threats/cve-2026-119776-in-all-prior-released-versions-of-frrouting-the-ospfv3-for-ipv6)
- [FRRouting Denial of Service in rfapiRibBi2Ri function](https://junglewise.ai/threats/cve-2026-37460-frrouting-denial-of-service-in-rfapiribbi2ri-function)
- [FRRouting integer underflow in BGP UPDATE message parsing](https://junglewise.ai/threats/cve-2026-37459-frrouting-integer-underflow-in-bgp-update-message-parsing)
- [FRRouting FRR denial of service in MP_REACH_NLRI component](https://junglewise.ai/threats/cve-2026-37458-frrouting-frr-denial-of-service-in-mp-reach-nlri-component)
- [FRRouting FRR out-of-bounds write in bgp_flowspec_op_decode](https://junglewise.ai/threats/cve-2026-37457-frrouting-frr-out-of-bounds-write-in-bgp-flowspec-op-decode)