# CVE-2026-37457: FRRouting FRR out-of-bounds write in bgp_flowspec_op_decode

Source: https://junglewise.ai/threats/cve-2026-37457-frrouting-frr-out-of-bounds-write-in-bgp-flowspec-op-decode  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-01. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-37457 · Severity: high · CVSS 7.5 · Published 2026-05-01

FRRouting (FRR) is an open-source routing software suite used to manage network traffic on servers and routers. A flaw in how it processes specific network routing instructions (FlowSpec) allows a remote attacker to crash the routing service. This can lead to a denial-of-service (DoS) condition, disrupting network connectivity and traffic flow for affected systems.

Technologies: [Frrouting](https://junglewise.ai/threats/technologies/frrouting). Vendors: [Frrouting](https://junglewise.ai/threats/vendors/frrouting).

## Quick answers

**Is CVE-2026-37457 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37457 being exploited in the wild.

**How severe is CVE-2026-37457?** High severity, with a CVSS score of 7.5, published 1 May 2026.

**Which products and versions are affected?** Frrouting 10.0.

**Is there a fix for CVE-2026-37457?** A patch was published on 2026-05-01: Fix committed to FRRouting GitHub repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-37457 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-37457?** Check whether you run Frrouting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An off-by-one out-of-bounds write vulnerability exists in the bgp_flowspec_op_decode() and bgp_flowspec_bitmask_decode() functions within bgpd/bgp_flowspec_util.c. The root cause is an incorrect bounds check (using '>' instead of '>=') when validating the number of chained operators against the BGP_PBR_MATCH_VAL_MAX limit. A remote, unauthenticated attacker can exploit this by supplying a crafted FlowSpec component with more than five chained operators, leading to a write past the end of the mval[] array. This memory corruption results in a crash of the BGP daemon (bgpd). A patch has been committed to the FRRouting repository to correct the loop boundary logic.

## Affected products

- FRRouting FRRouting (FRR) 10.0

## Timeline

- 2026-05-01: advisory: CVE published by MITRE/NVD
- 2026-05-01: patched: Fix committed to FRRouting GitHub repository

## References

- [https://github.com/FRRouting/frr/commit/0e6882bc72c0278988a47b2f0f73b7a91099a25c](https://github.com/FRRouting/frr/commit/0e6882bc72c0278988a47b2f0f73b7a91099a25c)

## Related threats

- [FRRouting OSPFv3 spoofed packet acceptance](https://junglewise.ai/threats/cve-2026-119776-in-all-prior-released-versions-of-frrouting-the-ospfv3-for-ipv6)
- [FRRouting Denial of Service in rfapiRibBi2Ri function](https://junglewise.ai/threats/cve-2026-37460-frrouting-denial-of-service-in-rfapiribbi2ri-function)
- [FRRouting integer underflow in BGP UPDATE message parsing](https://junglewise.ai/threats/cve-2026-37459-frrouting-integer-underflow-in-bgp-update-message-parsing)
- [FRRouting FRR denial of service in MP_REACH_NLRI component](https://junglewise.ai/threats/cve-2026-37458-frrouting-frr-denial-of-service-in-mp-reach-nlri-component)
- [FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment…](https://junglewise.ai/threats/cve-2026-28532-frrouting-before-10-5-3-contains-an-integer-overflow)