Unrated severityNVD Advisory· Published Nov 6, 2023· Updated Nov 4, 2025

CVE-2023-38406

Description

bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."

Affected products

Frrouting/Frrcpe-rescue
osv-coords17 versions
pkg:rpm/almalinux/frr pkg:rpm/almalinux/frr-selinux pkg:rpm/opensuse/frr&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/frr&distro=openSUSE%20Leap%2015.6 pkg:rpm/opensuse/frr&distro=openSUSE%20Tumbleweed pkg:rpm/suse/frr&distro=SUSE%20Enterprise%20Storage%207.1 pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP3-LTSS pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-ESPOS pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP4-LTSS pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP5 pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP6 pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP3-LTSS pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP4-LTSS pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP3 pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP4 pkg:rpm/suse/frr&distro=SUSE%20Manager%20Proxy%204.3 pkg:rpm/suse/frr&distro=SUSE%20Manager%20Server%204.3
< 7.5.1-13.el8_9.3.alma.1+ 16 more
- (no CPE)range: < 7.5.1-13.el8_9.3.alma.1
- (no CPE)range: < 7.5.1-13.el8_9.3.alma.1
- (no CPE)range: < 8.4-150500.4.15.1
- (no CPE)range: < 8.5.6-150500.4.30.1
- (no CPE)range: < 8.4-8.1
- (no CPE)range: < 7.4-150300.4.26.1
- (no CPE)range: < 7.4-150300.4.26.1
- (no CPE)range: < 7.4-150300.4.26.1
- (no CPE)range: < 7.4-150300.4.26.1
- (no CPE)range: < 8.4-150500.4.15.1
- (no CPE)range: < 8.5.6-150500.4.30.1
- (no CPE)range: < 7.4-150300.4.26.1
- (no CPE)range: < 7.4-150300.4.26.1
- (no CPE)range: < 7.4-150300.4.26.1
- (no CPE)range: < 7.4-150300.4.26.1
- (no CPE)range: < 7.4-150300.4.26.1
- (no CPE)range: < 7.4-150300.4.26.1

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

lists.debian.org/debian-lts-announce/2024/04/msg00019.htmlmitremailing-list
github.com/FRRouting/frr/compare/frr-8.4.2...frr-8.4.3mitre
github.com/FRRouting/frr/pull/12884mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000