RHSA-2026:24347HighCVSS 7.5

Red Hat Security Advisory: frr security update

Published
June 8, 2026
Last Modified
August 3, 2026

🔗 CVE IDs covered (3)

CVE-2026-37457 →CVE-2026-37459 →CVE-2026-37460 →

📋 Description

CVE-2026-37457 — frr: denial of service via crafted FlowSpec component CVE-2026-37459 — frr: denial of service via crafted BGP UPDATE message CVE-2026-37460 — frr: FRRouting: Denial of Service via crafted BGP UPDATE message

🎯 Affected products15

  • Red Hat Enterprise Linux AppStream (v. 10)
  • frr-0:10.4.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-0:10.4.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-0:10.4.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-0:10.4.4-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-0:10.4.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-debuginfo-0:10.4.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-debuginfo-0:10.4.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-debuginfo-0:10.4.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-debuginfo-0:10.4.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-debugsource-0:10.4.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-debugsource-0:10.4.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-debugsource-0:10.4.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-debugsource-0:10.4.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • frr-selinux-0:10.4.4-1.el10_2.noarch as a component of Red Hat Enterprise Linux AppStream (v. 10)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this issue, restrict access to FRRouting's BGP services to only trusted peers and networks. Implement firewall rules to limit inbound connections to BGP port 179 (TCP) to known, legitimate BGP neighbors. If BGP is not actively used, consider disabling the BGP daemon within FRR to eliminate the attack surface. Warning: Modifying firewall rules or FRR configuration may impact network connectivity and requires careful planning and testing. A restart of the FRR service may be required for changes to take effect.

🔗 References (6)