Read the docs
TI-2026-22790 Aliases CVE-2026-28532GHSA-wjc3-2qjv-c8fp

FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions

Priority LOW 26CWE-125Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-125 and the CVSS impact.

Summary

FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00225 13th percentileScored 2026-11-07
Fix Partial frr (FRRouting): 10.5.3Red Hat: 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FRRoutingfrrbefore 10.5.310.5.3Patch availableCNA
  • frr VendorFRRouting Affected before 10.5.3 Fixed in 10.5.3 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*before 10.5.3VulnerableFRRouting
  • cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:* Versions before 10.5.3 Vulnerable ·FRRouting

Remediation

  • Fix · CNA frr (FRRouting) Fixed in 10.5.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-28532
  2. 2026-10-03 Alias added: GHSA-wjc3-2qjv-c8fp

References

Patch 2

Other 1

  • TI-2023-20107 FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause… CVSS 3.1HIGH 7.5
  • TI-2023-21958 An issue was discovered in FRRouting FRR 9.0. CVSS 3.1CRITICAL 9.8
  • TI-2024-29658 An issue was discovered in FRRouting (FRR) through 10.1. CVSS 3.1CRITICAL 9.8
  • TI-2023-21957 An issue was discovered in FRRouting FRR through 9.0. CVSS 3.1CRITICAL 9.1
  • TI-2023-19790 bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow." CVSS 3.1CRITICAL 9.8
  • TI-2022-17234 An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a… CVSS 3.1CRITICAL 9.1
See all 47 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences