CVE catalog

CVE-2026-37460

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPD

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.34% · Oct 25, 2026

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianfrrsid10.7.1-6fixed
Debianfrrforky10.7.1-6fixed
Debianfrrtrixie10.3-3+deb13u1vulnerable
Debianfrrtrixie-security10.3-3+deb13u1vulnerable
Debianfrrbookworm8.4.4-1.1~deb12u2vulnerable
Debianfrrbookworm-security8.4.4-1.1~deb12u2vulnerable
CpefrrNot reportedNot reportedvulnerable
Ubuntuquaggapro1.1.1-3vulnerable
Ubuntuquaggapro1.1.1-3ubuntu1vulnerable
Ubuntuquaggapro1.2.2-1vulnerable
Ubuntuquaggapro1.2.2-1ubuntu1vulnerable
Ubuntuquaggapro1.2.4-1vulnerable
Ubuntuquaggapro1.2.4-1ubuntu0.1~esm1vulnerable
Ubuntuquaggapro1.2.4-1ubuntu0.1~esm2vulnerable
Ubuntuquagga20.041.2.4-4build1vulnerable
Ubuntuquagga20.041.2.4-4ubuntu0.1vulnerable
Ubuntuquagga20.041.2.4-4ubuntu0.4vulnerable
Ubuntuquagga20.041.2.4-4ubuntu0.5vulnerable
Ubuntufrrpro6.0.2-2build2vulnerable
Ubuntufrrpro7.2-1ubuntu1vulnerable
Ubuntufrrpro7.2-1ubuntu2vulnerable
Ubuntufrrpro7.2.1-1vulnerable
Ubuntufrrpro7.2.1-1ubuntu0.1vulnerable
Ubuntufrrpro7.2.1-1ubuntu0.2vulnerable
Ubuntufrrpro7.2.1-1ubuntu0.2+esm1vulnerable
Ubuntufrrpro7.2.1-1ubuntu0.2+esm2vulnerable
Ubuntufrrpro7.2.1-1ubuntu0.2+esm3vulnerable
Ubuntufrrpro7.2.1-1ubuntu0.2+esm4fixed
Ubuntufrr22.047.5.1-1.1vulnerable
Ubuntufrr22.048.1-1vulnerable
Ubuntufrr22.048.1-1ubuntu1vulnerable
Ubuntufrr22.048.1-1ubuntu1.1vulnerable
Ubuntufrr22.048.1-1ubuntu1.2vulnerable
Ubuntufrr22.048.1-1ubuntu1.3vulnerable
Ubuntufrr22.048.1-1ubuntu1.4vulnerable
Ubuntufrr22.048.1-1ubuntu1.5vulnerable
Ubuntufrr22.048.1-1ubuntu1.6vulnerable
Ubuntufrr22.048.1-1ubuntu1.7vulnerable
Ubuntufrr22.048.1-1ubuntu1.8vulnerable
Ubuntufrr22.048.1-1ubuntu1.9vulnerable
Ubuntufrr22.048.1-1ubuntu1.10vulnerable
Ubuntufrr22.048.1-1ubuntu1.11vulnerable
Ubuntufrr22.048.1-1ubuntu1.13vulnerable
Ubuntufrr22.048.1-1ubuntu1.14vulnerable
Ubuntufrr22.048.1-1ubuntu1.15fixed
Ubuntufrr24.048.4.4-1.1ubuntu1vulnerable
Ubuntufrr24.048.4.4-1.1ubuntu3vulnerable
Ubuntufrr24.048.4.4-1.1ubuntu4vulnerable
Ubuntufrr24.048.4.4-1.1ubuntu5vulnerable
Ubuntufrr24.048.4.4-1.1ubuntu6vulnerable
Ubuntufrr24.048.4.4-1.1ubuntu6.1vulnerable
Ubuntufrr24.048.4.4-1.1ubuntu6.2vulnerable
Ubuntufrr24.048.4.4-1.1ubuntu6.3vulnerable
Ubuntufrr24.048.4.4-1.1ubuntu6.4vulnerable
Ubuntufrr24.048.4.4-1.1ubuntu6.5vulnerable
Ubuntufrr24.048.4.4-1.1ubuntu6.6fixed
Ubuntufrr25.1010.2.1-1ubuntu3vulnerable
Ubuntufrr25.1010.3-3ubuntu2vulnerable
Ubuntufrr25.1010.4.1-3ubuntu1vulnerable
Ubuntufrr25.1010.4.1-3ubuntu1.1vulnerable
Ubuntufrr25.1010.4.1-3ubuntu1.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianfrrsourcesid10.6.1-1not yet assignedNot reportedNot reported
Debianfrrsourceforky10.6.1-1not yet assignedNot reportedNot reported
Debianfrrsourcetrixie(unfixed)not yet assignedNot reportedNot reported
Debianfrrsourcebookworm(unfixed)not yet assignedNot reportedNot reported
Ubuntufrrdebpro7.2.1-1ubuntu0.2+esm4Not reportedUBUNTU-CVE-2026-37460Not reported
Ubuntufrrdeb22.048.1-1ubuntu1.15Not reportedUBUNTU-CVE-2026-37460Not reported
Ubuntufrrdeb24.048.4.4-1.1ubuntu6.6Not reportedUBUNTU-CVE-2026-37460Not reported
Ubuntufrrdeb25.1010.4.1-3ubuntu1.2Not reportedUBUNTU-CVE-2026-37460Not reported

Notes

[trixie] frr: Minor issue [bookworm] frr: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [frr]Affected
    Details (4)

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm-security

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm-security

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

  • [frr-doc]Affected

    Source package: [frr]

    Details (4)

    • 8.4.4-1.1~deb12u2 · all · bookworm

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · all · bookworm

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · all · bookworm-security

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · all · bookworm-security

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

  • [frr-pythontools]Affected

    Source package: [frr]

    Details (4)

    • 8.4.4-1.1~deb12u2 · all · bookworm

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · all · bookworm

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · all · bookworm-security

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · all · bookworm-security

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

  • [frr-rpki-rtrlib]Affected

    Source package: [frr]

    Details (4)

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm-security

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm-security

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

  • [frr-snmp]Affected

    Source package: [frr]

    Details (4)

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · amd64 · bookworm-security

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

    • 8.4.4-1.1~deb12u2 · arm64 · bookworm-security

      Affected

      nvd · frr · debian · bookworm; nvd · frr · debian · 12

[Debian 13 (Trixie)]

  • [frr]Affected
    Details (4)

    • 10.3-3+deb13u1 · amd64 · trixie

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · arm64 · trixie

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · amd64 · trixie-security

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · arm64 · trixie-security

      Affected

      nvd · frr · debian · 13

  • [frr-doc]Affected

    Source package: [frr]

    Details (4)

    • 10.3-3+deb13u1 · all · trixie

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · all · trixie

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · all · trixie-security

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · all · trixie-security

      Affected

      nvd · frr · debian · 13

  • [frr-pythontools]Affected

    Source package: [frr]

    Details (4)

    • 10.3-3+deb13u1 · all · trixie

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · all · trixie

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · all · trixie-security

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · all · trixie-security

      Affected

      nvd · frr · debian · 13

  • [frr-rpki-rtrlib]Affected

    Source package: [frr]

    Details (4)

    • 10.3-3+deb13u1 · amd64 · trixie

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · arm64 · trixie

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · amd64 · trixie-security

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · arm64 · trixie-security

      Affected

      nvd · frr · debian · 13

  • [frr-snmp]Affected

    Source package: [frr]

    Details (4)

    • 10.3-3+deb13u1 · amd64 · trixie

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · arm64 · trixie

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · amd64 · trixie-security

      Affected

      nvd · frr · debian · 13

    • 10.3-3+deb13u1 · arm64 · trixie-security

      Affected

      nvd · frr · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]