TI-2022-09592 Aliases CVE-2022-26129 GHSA-54p4-8qjr-jvgc

Memory corruption in FRRouting

LOW 38CWE-119Published 2022-03-03 · Updated 2025-11-04

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subtlv, parse_ihu_subtlv, and parse_update_subtlv in babeld/message.c.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.01014 63rd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	FRRouting	through 8.1.0	—	No fix listed	CNA

FRRouting Vendor— Affected through 8.1.0 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:frrouting:frrouting::::::::	up to 8.1	Vulnerable	FRRouting

cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:* Versions up to 8.1 Vulnerable ·FRRouting

Remediation

No fixed version listed by the sources yet.

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products

Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 9

Timeline

2026-10-02 Threatist record created from CVE-2022-26129
2026-10-03 Alias added: GHSA-54p4-8qjr-jvgc

References

Exploit 1

https://github.com/FRRouting/frr/issues/10503

Other 1

https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html

TI-2023-20107 FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause… CVSS 3.1HIGH 7.5
TI-2023-21958 An issue was discovered in FRRouting FRR 9.0. CVSS 3.1CRITICAL 9.8
TI-2024-29658 An issue was discovered in FRRouting (FRR) through 10.1. CVSS 3.1CRITICAL 9.8
TI-2023-21957 An issue was discovered in FRRouting FRR through 9.0. CVSS 3.1CRITICAL 9.1
TI-2023-19790 bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow." CVSS 3.1CRITICAL 9.8
TI-2022-17234 An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a… CVSS 3.1CRITICAL 9.1

See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences