FRRouting is a widely deployed, community-driven routing protocol suite that implements BGP, OSPF, and other dynamic routing daemons across enterprise networks, ISP infrastructure, and cloud environments, where its role in the network control plane elevates the impact of any flaw. Vulnerabilities affecting this vendor skew toward serious outcomes, with a meaningful share reaching critical severity, and stem from the memory-safety demands of parsing complex routing protocol packets and managing long-lived daemon state. The exposure recurs in the core FRRouting daemon itself through characteristic weakness classes including NULL-pointer dereferences, out-of-bounds reads, and classic buffer overflows that are typical of C-based network software parsing untrusted input at scale. Despite the vendor's narrow product scope, its position at the network boundary and prevalence in operator deployments means that flaws here can propagate widely and affect routing availability and integrity across interconnected systems. Live severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Frrouting over time
Signals from CVEs in this vendor scope (48 CVEs).
48 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-37457HIGH An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denia | May 1, 2026 | 7.5 | 33 | NO | NO |
CVE-2022-37032CRITICAL An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service. This occurs in bgp_capability_msg_parse in bgpd/bgp_pack | Sep 19, 2022 | 9.1 | 29 | NO | NO |
CVE-2026-28532MEDIUM FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable | Apr 30, 2026 | 6.5 | 27 | NO | NO |
CVE-2023-41361CRITICAL An issue was discovered in FRRouting FRR 9.0. bgpd/bgp_open.c does not check for an overly large length of the rcv software version. | Aug 29, 2023 | 9.8 | 27 | NO | NO |
CVE-2022-37035HIGH An issue was discovered in bgpd in FRRouting (FRR) 8.3. In bgp_notify_send_with_data() and bgp_process_packet() in bgp_packet.c, there is a possible use-after-free due to a race co | Aug 2, 2022 | 8.1 | 27 | NO | NO |
CVE-2023-41359CRITICAL An issue was discovered in FRRouting FRR through 9.0. There is an out-of-bounds read in bgp_attr_aigp_valid in bgpd/bgp_attr.c because there is no check for the availability of two | Aug 29, 2023 | 9.1 | 26 | NO | NO |
CVE-2022-26126HIGH Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to the use of strdup with a non-zero-terminated binary string in isis_nb_notifications.c. | Mar 3, 2022 | 7.8 | 26 | NO | NO |
CVE-2017-15865HIGH bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers to obtain sensitive information via a m | Nov 8, 2017 | 7.5 | 26 | NO | NO |
CVE-2025-61107HIGH FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vulnerability allows at | Oct 28, 2025 | 7.5 | 25 | NO | NO |
CVE-2025-61106HIGH FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vulnerability allows at | Oct 28, 2025 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (48 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Frrouting.
Media articles that mention a CVE ID that affects a product developed by Frrouting — matched by CVE ID, not by vendor name.