# CVE-2026-37458: FRRouting FRR denial of service in MP_REACH_NLRI component

Source: https://junglewise.ai/threats/cve-2026-37458-frrouting-frr-denial-of-service-in-mp-reach-nlri-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-04. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-37458 · Severity: medium · CVSS 6.5 · Published 2026-05-04

FRRouting (FRR) is an open-source internet routing protocol suite used by network operators to manage traffic across infrastructure. A vulnerability in how the software handles specific routing update messages allows an authenticated attacker to crash the routing service. This results in a denial-of-service condition that can disrupt network connectivity and traffic flow.

Technologies: [Frrouting](https://junglewise.ai/threats/technologies/frrouting). Vendors: [Frrouting](https://junglewise.ai/threats/vendors/frrouting).

## Quick answers

**Is CVE-2026-37458 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-37458 being exploited in the wild.

**How severe is CVE-2026-37458?** Medium severity, with a CVSS score of 6.5, published 4 May 2026.

**Which products and versions are affected?** FRRouting FRRouting (FRR) stable/10.0 to stable/10.6.

**Is there a fix for CVE-2026-37458?** A patch was published on 2026-05-11: NIST analysis and patch reference added Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-37458 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-37458?** Check whether you run Frrouting. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the BGP daemon (bgpd) of FRRouting due to improper input validation within the MP_REACH_NLRI (Multiprotocol Reachable NLRI) attribute parser. Specifically, the component fails to properly validate IPv4 'martian' (reserved or invalid) next-hop addresses in the bgp_mp_reach_parse function in bgp_attr.c. An authenticated remote attacker can exploit this by sending a specially crafted BGP UPDATE message containing an invalid next-hop address. This can trigger a service crash or inconsistent routing state, leading to a Denial of Service (DoS). A patch has been developed to ensure MP_REACH_NLRI attributes are validated against incorrect next-hops, consistent with existing NEXT_HOP attribute validation.

## Affected products

- FRRouting FRRouting (FRR) stable/10.0 to stable/10.6

## Timeline

- 2026-05-04: advisory: Initial disclosure of CVE-2026-37458
- 2026-05-11: patched: NIST analysis and patch reference added

## References

- [https://github.com/FRRouting/frr/commit/8102a8aeceb9f86fdfe1f80cd77080522bab69c8](https://github.com/FRRouting/frr/commit/8102a8aeceb9f86fdfe1f80cd77080522bab69c8)
- [https://github.com/mertsatilmaz/vulnerability-research/blob/main/advisories/CVE-2026-36365.md](https://github.com/mertsatilmaz/vulnerability-research/blob/main/advisories/CVE-2026-36365.md)

## Related threats

- [FRRouting OSPFv3 spoofed packet acceptance](https://junglewise.ai/threats/cve-2026-119776-in-all-prior-released-versions-of-frrouting-the-ospfv3-for-ipv6)
- [FRRouting Denial of Service in rfapiRibBi2Ri function](https://junglewise.ai/threats/cve-2026-37460-frrouting-denial-of-service-in-rfapiribbi2ri-function)
- [FRRouting integer underflow in BGP UPDATE message parsing](https://junglewise.ai/threats/cve-2026-37459-frrouting-integer-underflow-in-bgp-update-message-parsing)
- [FRRouting FRR out-of-bounds write in bgp_flowspec_op_decode](https://junglewise.ai/threats/cve-2026-37457-frrouting-frr-out-of-bounds-write-in-bgp-flowspec-op-decode)
- [FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment…](https://junglewise.ai/threats/cve-2026-28532-frrouting-before-10-5-3-contains-an-integer-overflow)