Is CVE-2026-119776 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119776 being exploited in the wild.

How severe is CVE-2026-119776?

Informational severity, published 4 November 2026.

Which products and versions are affected?

Frrouting all prior released versions.

How is CVE-2026-119776 attacked?

It is attacked over the network.

Am I affected by CVE-2026-119776?

Check whether you run Frrouting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119776: FRRouting OSPFv3 spoofed packet acceptance

CVE-2026-119776 · Severity: info · Published 2026-11-04

FRRouting is a routing daemon used to manage IPv6 network traffic on Linux systems. OSPFv3, the IPv6 variant of the OSPF protocol, did not validate that incoming packets came from link-local sources and were destined to valid multicast groups, allowing attackers on distant networks to forge OSPF adjacencies and potentially disrupt routing. While OSPFv3 authentication (if enabled) prevents full exploitation, attackers can still waste CPU resources on authentication validation.

Technologies: Frrouting. Vendors: Frrouting.

Quick answers

Is CVE-2026-119776 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119776 being exploited in the wild.
How severe is CVE-2026-119776?: Informational severity, published 4 November 2026.
Which products and versions are affected?: Frrouting all prior released versions.
Is there a fix for CVE-2026-119776?: No fixed version is recorded yet. Enable OSPFv3 authentication trailers per RFC 7166, which prevents rogue adjacency formation (though attackers can still trigger authentication CPU overhead). Restrict IPv6 connectivity to OSPFv3 peers via firewall rules that reject packets from non-link-local sources or invalid multicast destinations. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119776 attacked?: It is attacked over the network.
Am I affected by CVE-2026-119776?: Check whether you run Frrouting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Enable OSPFv3 authentication trailers per RFC 7166, which prevents rogue adjacency formation (though attackers can still trigger authentication CPU overhead). Restrict IPv6 connectivity to OSPFv3 peers via firewall rules that reject packets from non-link-local sources or invalid multicast destinations.

Technical details

The OSPFv3 implementation in FRRouting fails to check that inbound Hello packets originate from link-local IPv6 addresses or are destined to valid OSPFv3 multicast groups (ff02::5 or ff02::6) or link-local unicast. An attacker on any IPv6-connected network can craft and send Hello packets from global unicast or other invalid addresses, bypassing network firewall assumptions and creating rogue OSPFv3 neighbors. RFC 7166 authentication trailers mitigate full adjacency hijacking but do not prevent the CPU waste from processing invalid packets.

Affected products

FRRouting FRRouting all prior released versions

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.