Junglewise Threat Intelligence

CVE-2026-37459: FRRouting integer underflow in BGP UPDATE message parsing

CVE-2026-37459 · Severity: high · CVSS 7.5 · Published 2026-05-04

Technologies: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Frrouting, Red Hat Enterprise Linux 10. Vendors: Red Hat, Frrouting.

Executive brief

FRRouting (FRR) is an open-source software suite used to manage network routing protocols like BGP on Linux and Unix systems. A vulnerability in how it handles certain network update messages allows an attacker to crash the routing service remotely. This can lead to a total loss of network connectivity for the affected systems, disrupting business operations and data flow.

Technical details

An integer underflow vulnerability exists in the BGP daemon (bgpd) of FRRouting (FRR) within the `bgp_attr_nhc` function in `bgp_attr.c`. The root cause is an insufficient length check when parsing Next Hop Capability (NHC) Type-Length-Value (TLV) structures; specifically, the code fails to account for the TLV header size when validating the remaining stream length. A remote, unauthenticated attacker can exploit this by sending a specially crafted BGP UPDATE message, leading to uncontrolled resource consumption or a process crash (Denial of Service). The issue is addressed in the FRR source code by ensuring the remaining length is sufficient to cover both the TLV value and the header. Patches are available via FRR commits and downstream vendor updates from Red Hat.

Affected products

  • FRRouting FRRouting stable/10.0 to stable/10.6
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 10

Timeline

  • 2026-05-04: advisory: Initial NVD publication date
  • 2026-05-04: other: Upstream patch committed to GitHub
  • 2026-06-08: patched: Red Hat released security updates (RHSA-2026:24347, RHSA-2026:24370)

References

Related threats