Read the docs
TI-2026-28049 Aliases CVE-2026-37460GHSA-4ph9-3c4q-r2hh

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR)…

Priority LOW 39CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat.

Summary

Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00335 26th percentileScored 2026-11-07
Fix Fixed Red Hat: 4 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

Remediation

Red Hat 4 advisories

  • RHSA-2026:49607 Released 2026-08-03 · Red Hat rating Important
    frr10 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) frr10-10.4.3-3.el9_8.2, frr10-selinux-10.4.3-3.el9_8.2
  • RHSA-2026:49527 Released 2026-08-03 · Red Hat rating Important
    frr security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 9) frr-8.5.3-15.el9_8.1, frr-selinux-8.5.3-15.el9_8.1
  • RHSA-2026:49511 Released 2026-08-03 · Red Hat rating Important
    frr security update
    • Red Hat Enterprise Linux AppStream (v. 8) frr-7.5.1-25.el8_10, frr-selinux-7.5.1-25.el8_10
Show 1 more Red Hat advisories
  • RHSA-2026:24347 Released 2026-06-08 · Red Hat rating Important
    frr security update
    • Red Hat Enterprise Linux AppStream (v. 10) frr-10.4.4-1.el10_2, frr-selinux-10.4.4-1.el10_2

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:24347
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:49511
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:49527, RHSA-2026:49607

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-37460
  2. 2026-10-03 Alias added: GHSA-4ph9-3c4q-r2hh
  3. 2026-10-25 Priority changed: MEDIUM → LOW

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences