PT-2026-36526 · Frrouting+4 · Frrouting+4

Jiahao Lei · CVE-2026-37457 · Published 2026-05-01 · Updated 2026-06-29

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FRRouting version stable/10.0

Description An off-by-one out-of-bounds write issue exists in the bgp flowspec op decode() function located in bgpd/bgp flowspec util.c. This flaw allows attackers to trigger a Denial of Service (DoS) by providing a specially crafted FlowSpec component.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALSA-2026:24340

ALSA-2026:24347

ALSA-2026:24370

ALSA-2026:24371

BDU:2026-09837

CVE-2026-37457

OPENSUSE-SU-2026:10721-1

OPENSUSE-SU-2026:20898-1

RHSA-2026:24340

RHSA-2026:24347

RHSA-2026:24370

RHSA-2026:24371

SUSE-SU-2026:22026-1

SUSE-SU-2026:2454-1

SUSE-SU-2026:2455-1

SUSE-SU-2026:2457-1

SUSE-SU-2026:2644-1

USN-8376-1

Affected Products

Frrouting

Linuxmint

Red Os

Rocky Linux

Ubuntu

References · 70

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37457.json · Exploit
• https://github.com/FRRouting/frr/commit/0e6882bc72c0278988a47b2f0f73b7a91099a25c · Patch
• https://osv.dev/vulnerability/SUSE-SU-2026:2457-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2026-24340.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-37457 · Security Note
• https://linux.oracle.com/errata/ELSA-2026-24370.html · Vendor Advisory
• https://errata.almalinux.org/10/ALSA-2026-24347.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-37457 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-37458 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2026-24371.html · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:24340 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:24347 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:24371 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:2644-1 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2026:24340 · Vendor Advisory