Is CVE-2026-37458 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37458 being exploited in the wild.

How severe is CVE-2026-37458?

Medium severity, with a CVSS score of 6.5, published 4 May 2026.

Which products and versions are affected?

FRRouting FRRouting (FRR) stable/10.0 to stable/10.6.

Is there a fix for CVE-2026-37458?

A patch was published on 2026-05-11: NIST analysis and patch reference added Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-37458 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-37458?

Check whether you run Frrouting. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37458: FRRouting FRR denial of service in MP_REACH_NLRI component

CVE-2026-37458 · Severity: medium · CVSS 6.5 · Published 2026-05-04

FRRouting (FRR) is an open-source internet routing protocol suite used by network operators to manage traffic across infrastructure. A vulnerability in how the software handles specific routing update messages allows an authenticated attacker to crash the routing service. This results in a denial-of-service condition that can disrupt network connectivity and traffic flow.

Technologies: Frrouting. Vendors: Frrouting.

Quick answers

Is CVE-2026-37458 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37458 being exploited in the wild.
How severe is CVE-2026-37458?: Medium severity, with a CVSS score of 6.5, published 4 May 2026.
Which products and versions are affected?: FRRouting FRRouting (FRR) stable/10.0 to stable/10.6.
Is there a fix for CVE-2026-37458?: A patch was published on 2026-05-11: NIST analysis and patch reference added Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-37458 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-37458?: Check whether you run Frrouting. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the BGP daemon (bgpd) of FRRouting due to improper input validation within the MP_REACH_NLRI (Multiprotocol Reachable NLRI) attribute parser. Specifically, the component fails to properly validate IPv4 'martian' (reserved or invalid) next-hop addresses in the bgp_mp_reach_parse function in bgp_attr.c. An authenticated remote attacker can exploit this by sending a specially crafted BGP UPDATE message containing an invalid next-hop address. This can trigger a service crash or inconsistent routing state, leading to a Denial of Service (DoS). A patch has been developed to ensure MP_REACH_NLRI attributes are validated against incorrect next-hops, consistent with existing NEXT_HOP attribute validation.

Affected products

FRRouting FRRouting (FRR) stable/10.0 to stable/10.6

Timeline

2026-05-04: advisory: Initial disclosure of CVE-2026-37458
2026-05-11: patched: NIST analysis and patch reference added

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.