UbuntuUpdates.org

Package "frr"

Name: frr

Description:

FRRouting Internet routing protocol suite
Latest version: 10.5.1-1ubuntu4.1
Release: resolute (26.04)
Level: security
Repository: main
Homepage: https://github.com/FRRouting/frr

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "frr"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "frr" in Resolute

Repository Area Version
base universe 10.5.1-1ubuntu4
base main 10.5.1-1ubuntu4
security universe 10.5.1-1ubuntu4.1
updates main 10.5.1-1ubuntu4.1
updates universe 10.5.1-1ubuntu4.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 10.5.1-1ubuntu4.1 2026-06-03 18:07:53 UTC

  frr (10.5.1-1ubuntu4.1) resolute-security; urgency=medium

  * SECURITY UPDATE: integer overflow in OSPF parsing
    - debian/patches/CVE-2026-28532.patch: ospfd: harden TE/SR TLV iteration
      against malformed lengths in ospfd/ospf_sr.c, ospfd/ospf_te.c.
    - CVE-2026-28532
  * SECURITY UPDATE: DoS via crafted FlowSpec component
    - debian/patches/CVE-2026-37457.patch: bgpd: fix off-by-one error in
      FlowSpec operator array bounds check in bgpd/bgp_flowspec_util.c.
    - CVE-2026-37457
  * SECURITY UPDATE: DoS via crafted UPDATE message
    - debian/patches/CVE-2026-37458.patch: bgpd: Validate MP_REACH_NLRI
      attribute against incorrect next-hop in bgpd/bgp_attr.c.
    - CVE-2026-37458
  * SECURITY UPDATE: DoS via crafted BGP UPDATE message
    - debian/patches/CVE-2026-37459.patch: bgpd: Check if the NHC length is
      enough to fill TLV value + TLV header in bgpd/bgp_attr.c.
    - CVE-2026-37459

 -- Marc Deslauriers <email address hidden> Sat, 30 May 2026 11:29:06 -0400
CVE-2026-28532 FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a
CVE-2026-37457 An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 al
CVE-2026-37458 Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows authenticated attackers to cause a Denia
CVE-2026-37459 An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UP


About   -   Send Feedback to @ubuntu_updates