High severity7.5NVD Advisory· Published May 1, 2026· Updated May 29, 2026

CVE-2026-37457

Description

An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted FlowSpec component.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Frrouting/Frroutingllm-fuzzy
Range: stable/10.0
osv-coords16 versions
pkg:rpm/almalinux/frr pkg:rpm/almalinux/frr10 pkg:rpm/almalinux/frr10-selinux pkg:rpm/almalinux/frr-selinux pkg:rpm/opensuse/frr&distro=openSUSE%20Tumbleweed pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-ESPOS pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20High%20Performance%20Computing%2015%20SP5-LTSS pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP7 pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5-LTSS pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP5-LTSS pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%2015%20SP6-LTSS pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%2016.0 pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP5 pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2015%20SP6 pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20applications%2016.0 pkg:rpm/suse/frr&distro=SUSE%20Linux%20Enterprise%20Server%20LTSS%20Extended%20Security%2012%20SP5
< 7.5.1-24.el8_10+ 15 more
- (no CPE)range: < 7.5.1-24.el8_10
- (no CPE)range: < 10.4.3-3.el9_8
- (no CPE)range: < 10.4.3-3.el9_8
- (no CPE)range: < 7.5.1-24.el8_10
- (no CPE)range: < 10.6.1-1.1
- (no CPE)range: < 8.5.7-150500.4.43.1
- (no CPE)range: < 8.5.7-150500.4.43.1
- (no CPE)range: < 8.5.7-150500.4.43.1
- (no CPE)range: < 8.5.7-8.16.1
- (no CPE)range: < 8.5.7-150500.4.43.1
- (no CPE)range: < 8.5.7-150500.4.43.1
- (no CPE)range: < 10.2.6-160000.1.1
- (no CPE)range: < 8.5.7-150500.4.43.1
- (no CPE)range: < 8.5.7-150500.4.43.1
- (no CPE)range: < 10.2.6-160000.1.1
- (no CPE)range: < 8.5.7-8.16.1

Patches

Vulnerability mechanics

References

github.com/FRRouting/frr/commit/0e6882bc72c0278988a47b2f0f73b7a91099a25cnvdPatch

News mentions

Patch Tuesday - May 2026
Rapid7 Blog · May 13, 2026

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000