Quick answers
- Is CVE-2026-37457 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-37457 being exploited in the wild.
- How severe is CVE-2026-37457?
- High severity, with a CVSS score of 7.5, published 1 May 2026.
- Which products and versions are affected?
- Frrouting 10.0.
- Is there a fix for CVE-2026-37457?
- A patch was published on 2026-05-01: Fix committed to FRRouting GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-37457 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-37457?
- Check whether you run Frrouting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An off-by-one out-of-bounds write vulnerability exists in the bgp_flowspec_op_decode() and bgp_flowspec_bitmask_decode() functions within bgpd/bgp_flowspec_util.c. The root cause is an incorrect bounds check (using '>' instead of '>=') when validating the number of chained operators against the BGP_PBR_MATCH_VAL_MAX limit. A remote, unauthenticated attacker can exploit this by supplying a crafted FlowSpec component with more than five chained operators, leading to a write past the end of the mval[] array. This memory corruption results in a crash of the BGP daemon (bgpd). A patch has been committed to the FRRouting repository to correct the loop boundary logic.
Affected products
- FRRouting FRRouting (FRR) 10.0
Timeline
- 2026-05-01: advisory: CVE published by MITRE/NVD
- 2026-05-01: patched: Fix committed to FRRouting GitHub repository