Executive brief
FRRouting (FRR) is an open-source routing software suite used to manage network traffic on servers and routers. A flaw in how it processes specific network routing instructions (FlowSpec) allows a remote attacker to crash the routing service. This can lead to a denial-of-service (DoS) condition, disrupting network connectivity and traffic flow for affected systems.
Technical details
An off-by-one out-of-bounds write vulnerability exists in the bgp_flowspec_op_decode() and bgp_flowspec_bitmask_decode() functions within bgpd/bgp_flowspec_util.c. The root cause is an incorrect bounds check (using '>' instead of '>=') when validating the number of chained operators against the BGP_PBR_MATCH_VAL_MAX limit. A remote, unauthenticated attacker can exploit this by supplying a crafted FlowSpec component with more than five chained operators, leading to a write past the end of the mval[] array. This memory corruption results in a crash of the BGP daemon (bgpd). A patch has been committed to the FRRouting repository to correct the loop boundary logic.
Affected products
- FRRouting FRRouting (FRR) 10.0
Timeline
- 2026-05-01: advisory: CVE published by MITRE/NVD
- 2026-05-01: patched: Fix committed to FRRouting GitHub repository