Executive brief
FRRouting (FRR) is an open-source internet routing protocol suite used by network operators to manage traffic across infrastructure. A vulnerability in how the software handles specific routing update messages allows an authenticated attacker to crash the routing service. This results in a denial-of-service condition that can disrupt network connectivity and traffic flow.
Technical details
A vulnerability exists in the BGP daemon (bgpd) of FRRouting due to improper input validation within the MP_REACH_NLRI (Multiprotocol Reachable NLRI) attribute parser. Specifically, the component fails to properly validate IPv4 'martian' (reserved or invalid) next-hop addresses in the bgp_mp_reach_parse function in bgp_attr.c. An authenticated remote attacker can exploit this by sending a specially crafted BGP UPDATE message containing an invalid next-hop address. This can trigger a service crash or inconsistent routing state, leading to a Denial of Service (DoS). A patch has been developed to ensure MP_REACH_NLRI attributes are validated against incorrect next-hops, consistent with existing NEXT_HOP attribute validation.
Affected products
- FRRouting FRRouting (FRR) stable/10.0 to stable/10.6
Timeline
- 2026-05-04: advisory: Initial disclosure of CVE-2026-37458
- 2026-05-11: patched: NIST analysis and patch reference added