CVE-2026-37458 | Medium | 6.5 | 2026-05-04 | Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denial of Servi… |
CVE-2026-37457 | High | 7.5 | 2026-05-01 | An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attac… |
CVE-2026-28532 | Medium | 6.5 | 2026-04-30 | FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t… |
CVE-2026-5107 | Medium | 4.2 | 2026-03-30 | A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN T… |
CVE-2025-61107 | High | 7.5 | 2025-10-28 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vu… |
CVE-2025-61106 | High | 7.5 | 2025-10-28 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vu… |
CVE-2025-61104 | High | 7.5 | 2025-10-28 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_unknown_tlv function at ospf_ext.c. This vulnerab… |
CVE-2025-61103 | High | 7.5 | 2025-10-28 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_lan_adj_sid function at ospf_ext.c. This… |
CVE-2025-61105 | High | 7.5 | 2025-10-27 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_link_info function at ospf_ext.c. This vulnerabil… |
CVE-2025-61102 | High | 7.5 | 2025-10-27 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_adj_sid function at ospf_ext.c. This vul… |
CVE-2025-61101 | High | 7.5 | 2025-10-27 | FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_rmt_itf_addr function at ospf_ext.c. Thi… |
CVE-2025-61100 | High | 7.5 | 2025-10-27 | FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the ospf_opaque_lsa_dump function at ospf_opaque.c. This vulne… |
CVE-2025-61099 | High | 7.5 | 2025-10-27 | FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the opaque_info_detail function at ospf_opaque.c. This vulnera… |
CVE-2024-44070 | High | 7.5 | 2024-08-19 | An issue was discovered in FRRouting (FRR) through 10.1. bgp_attr_encap in bgpd/bgp_attr.c does not check the actual remaining stream length before taking the… |
CVE-2024-34088 | High | 7.5 | 2024-04-30 | In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer. In cases where calling fun… |
CVE-2024-31951 | Medium | 6.5 | 2024-04-07 | In the Opaque LSA Extended Link parser in FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ext_link for OSPF LSA p… |
CVE-2024-31950 | Medium | 6.5 | 2024-04-07 | In FRRouting (FRR) through 9.1, there can be a buffer overflow and daemon crash in ospf_te_parse_ri for OSPF LSA packets during an attempt to read Segment Rout… |
CVE-2024-31949 | Medium | 6.5 | 2024-04-07 | In FRRouting (FRR) through 9.1, an infinite loop can occur when receiving a MP/GR capability as a dynamic capability because malformed data results in a pointe… |
CVE-2024-31948 | Medium | 6.5 | 2024-04-07 | In FRRouting (FRR) through 9.1, an attacker using a malformed Prefix SID attribute in a BGP UPDATE packet can cause the bgpd daemon to crash. |
CVE-2024-27913 | Medium | 6.5 | 2024-02-28 | ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) via a malformed OS… |
CVE-2023-38407 | High | 7.5 | 2023-11-06 | bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing. |
CVE-2023-38406 | Critical | 9.8 | 2023-11-06 | bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow." |
CVE-2023-47235 | High | 7.5 | 2023-11-03 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of… |
CVE-2023-47234 | High | 7.5 | 2023-11-03 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and add… |
CVE-2023-46753 | Medium | 5.9 | 2023-10-26 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an… |
CVE-2023-46752 | Medium | 5.9 | 2023-10-26 | An issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI data, leading to a crash. |
CVE-2023-41909 | High | 7.5 | 2023-09-05 | An issue was discovered in FRRouting FRR through 9.0. bgp_nlri_parse_flowspec in bgpd/bgp_flowspec.c processes malformed requests with no attributes, leading t… |
CVE-2023-38802 | High | 7.5 | 2023-08-29 | FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribut… |
CVE-2023-41361 | Critical | 9.8 | 2023-08-29 | An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version. |
CVE-2023-41360 | Critical | 9.1 | 2023-08-29 | An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c can read the initial byte of the ORF header in an ahead-of-stream situation. |
CVE-2023-41359 | Critical | 9.1 | 2023-08-29 | An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for th… |
CVE-2023-41358 | High | 7.5 | 2023-08-29 | An issue was discovered in FRRouting FRR through 9.0. bgpd/bgp_packet.c processes NLRIs if the attribute length is zero. |
CVE-2023-3748 | Low | 3.5 | 2023-07-24 | A flaw was found in FRRouting when parsing certain babeld unicast hello messages that are intended to be ignored. This issue may allow an attacker to send spec… |
CVE-2023-31490 | High | 7.5 | 2023-05-09 | An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function. |
CVE-2023-31489 | Medium | 5.5 | 2023-05-09 | An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_capability_llgr() function. |
CVE-2022-43681 | Medium | 6.5 | 2023-05-03 | An out-of-bounds read exists in the BGP daemon of FRRouting FRR through 8.4. When sending a malformed BGP OPEN message that ends with the option length octet (… |
CVE-2022-40318 | Medium | 6.5 | 2023-05-03 | An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), att… |
CVE-2022-40302 | Medium | 6.5 | 2023-05-03 | An issue was discovered in bgpd in FRRouting (FRR) through 8.4. By crafting a BGP OPEN message with an option of type 0xff (Extended Length from RFC 9072), att… |
CVE-2022-36440 | High | 7.5 | 2023-04-03 | A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function. Attackers can maliciously construct BGP open packets and s… |
CVE-2022-37032 | Critical | 9.1 | 2022-09-19 | An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_p… |
CVE-2022-37035 | High | 8.1 | 2022-08-02 | An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-… |
CVE-2022-26129 | High | 7.8 | 2022-03-03 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subtlv, parse_ihu_subtl… |
CVE-2022-26128 | High | 7.8 | 2022-03-03 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld… |
CVE-2022-26127 | High | 7.8 | 2022-03-03 | A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to missing a check on the input packet length in the babel_packet_examin function in babe… |
CVE-2022-26126 | High | 7.8 | 2022-03-03 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c. |
CVE-2022-26125 | High | 7.8 | 2022-03-03 | Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the input packet length in isisd/isis_tlvs.c. |
CVE-2019-5892 | Medium | 6.5 | 2019-01-10 | bgpd in FRRouting FRR (aka Free Range Routing) 2.x and 3.x before 3.0.4, 4.x before 4.0.1, 5.x before 5.0.2, and 6.x before 6.0.2 (not affecting Cumulus Linux… |
CVE-2017-15865 | High | 7.5 | 2017-11-08 | bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers to obtain sensitiv… |