An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted FlowSpec component.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2454-1 advisory.

    This update for frr fixes the following issues

    Update to frr 8.5.7:

    - CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
    - CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
    - CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
    - CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).
      DoS via a crafted UPDATE message (bsc#1263974).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2455-1 advisory.

    This update for frr fixes the following issues

    - CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
    - CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
    - CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
    - CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2457-1 advisory.

    This update for frr fixes the following issue:

    - CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
    - CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
    - CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
    - CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0160 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2026-37457:
    An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function     (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service     (DoS) via supplying a crafted FlowSpec component.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:24371 advisory.

    * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:24347 advisory.

    * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

    * frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:24370 advisory.

    * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

    * frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:24340 advisory.

    * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-771:01 advisory.

    * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-24340 advisory.

    - Fix off-by-one error in FlowSpec operator array bounds checking (CVE-2026-37457)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:24371 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24370 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It takes a multi-server and multi-     threaded approach to resolve the current complexity of the Internet.  FRRouting supports BGP4, OSPFv2,     OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.  FRRouting is a fork of Quagga.

    Security Fix(es):

    * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

    * frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:24340 advisory.

    * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:24347 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

    * frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:24340 advisory.

    FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3,     ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

    Security Fix(es):

    * frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6322 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6322-1                   security@debian.org     https://www.debian.org/security/                                  Aron Xu     June 05, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : frr     CVE ID         : CVE-2023-3748 CVE-2024-27913 CVE-2024-31950 CVE-2024-31951                      CVE-2024-34088 CVE-2025-61099 CVE-2025-61100 CVE-2025-61101                      CVE-2025-61102 CVE-2025-61103 CVE-2025-61104 CVE-2025-61105                      CVE-2025-61106 CVE-2025-61107 CVE-2026-5107 CVE-2026-28532                      CVE-2026-37457 CVE-2026-37458     Debian Bug     :

    Several vulnerabilities were discovered in FRRouting (frr), a suite of     internet routing protocol daemons. A remote attacker could trigger these     issues by sending specially crafted protocol packets to a vulnerable     daemon, resulting in denial of service (infinite loops, NULL pointer     dereferences and crashes) or potentially the execution of arbitrary code     through out-of-bounds reads and writes and buffer overflows. The flaws     affect packet and attribute parsing in the BGP daemon (including FlowSpec,     EVPN/VNC NLRI and MP_REACH_NLRI handling), the OSPF daemon (Traffic     Engineering, Segment Routing and Opaque LSA processing) and the babeld     daemon.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 8.4.4-1.1~deb12u2.

    For the stable distribution (trixie), these problems have been fixed in     version 10.3-3+deb13u1.

    We recommend that you upgrade your frr packages.

    For the detailed security status of frr please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/frr

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8376-1 advisory.

    It was discovered that FRR incorrectly handled certain OSPF Traffic Engineering and Segment Routing TLVs.
    An attacker could possibly use this issue to cause FRR to crash, resulting in a denial of service.
    (CVE-2026-28532)

    It was discovered that FRR incorrectly handled certain BGP FlowSpec components. An attacker could possibly     use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2026-37457)

    It was discovered that FRR did not properly validate certain MP_REACH_NLRI messages. An authenticated user     could possibly use this issue to cause FRR to crash, resulting in a denial of service. (CVE-2026-37458)

    It was discovered that FRR incorrectly handled processing certain BGP UPDATE messages. An attacker could     possibly use this issue to cause FRR to crash, resulting in a denial of service. This issue only affected     Ubuntu 25.04 and Ubuntu 25.10. (CVE-2026-37459)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function     (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service     (DoS) via supplying a crafted FlowSpec component. (CVE-2026-37457)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
321756	SUSE SLES15 Security Update : frr (SUSE-SU-2026:2454-1)	Nessus	SuSE Local Security Checks	low
321747	SUSE SLES12 Security Update : frr (SUSE-SU-2026:2455-1)	Nessus	SuSE Local Security Checks	low
321691	SUSE SLES15 Security Update : frr (SUSE-SU-2026:2457-1)	Nessus	SuSE Local Security Checks	low
321240	Alibaba Cloud Linux 3 : 0160: frr (ALINUX3-SA-2026:0160)	Nessus	Alibaba Cloud Linux Local Security Checks	high
320614	RockyLinux 9 : frr (RLSA-2026:24371)	Nessus	Rocky Linux Local Security Checks	high
320612	RockyLinux 10 : frr (RLSA-2026:24347)	Nessus	Rocky Linux Local Security Checks	high
320607	RockyLinux 9 : frr10 (RLSA-2026:24370)	Nessus	Rocky Linux Local Security Checks	high
320522	RockyLinux 8 : frr (RLSA-2026:24340)	Nessus	Rocky Linux Local Security Checks	high
320206	MiracleLinux 8 : frr-7.5.1-24.el8_10 (AXSA:2026-771:01)	Nessus	Miracle Linux Local Security Checks	high
319715	Oracle Linux 8 : frr (ELSA-2026-24340)	Nessus	Oracle Linux Local Security Checks	high
319705	RHEL 9 : frr (RHSA-2026:24371)	Nessus	Red Hat Local Security Checks	high
319704	RHEL 9 : frr10 (RHSA-2026:24370)	Nessus	Red Hat Local Security Checks	high
319671	AlmaLinux 8 : frr (ALSA-2026:24340)	Nessus	Alma Linux Local Security Checks	high
319644	RHEL 10 : frr (RHSA-2026:24347)	Nessus	Red Hat Local Security Checks	high
319640	RHEL 8 : frr (RHSA-2026:24340)	Nessus	Red Hat Local Security Checks	high
318679	Debian dsa-6322 : frr - security update	Nessus	Debian Local Security Checks	low
318637	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : FRR vulnerabilities (USN-8376-1)	Nessus	Ubuntu Local Security Checks	medium
311705	Linux Distros Unpatched Vulnerability : CVE-2026-37457	Nessus	Misc.	high

Detections

Analytics

CVE-2026-37457

high

Tenable Plugins

low

low

low

high

high

high

high

high

high

high

high

high

high

high

high

low

medium

high