CVE-2026-37457 Memory corruption in n/a

High 7.5 Published 1 May 2026 Updated 15 Jul 2026

Attackers can cause a Denial of Service in FRRouting by sending crafted FlowSpec components that trigger an off-by-one out-of-bounds write.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-37457?

CVE-2026-37457 is a high-severity memory corruption vulnerability in n/a, published on 1 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_util.c) of FRRouting (FRR) stable/10.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted FlowSpec component.

Weakness: CWE-787

Which versions are affected by CVE-2026-37457?

It affects 1 product.

Linux distribution packages (14)

`frr` AlmaLinux:8	All versions	`7.5.1-24.el8_10`
`frr-selinux` AlmaLinux:8	All versions	`7.5.1-24.el8_10`
`frr` AlmaLinux:9	All versions	`8.5.3-13.el9_8`
`frr-selinux` AlmaLinux:9	All versions	`8.5.3-13.el9_8`
`frr` Red Hat:enterprise_linux:8::appstream	All versions	`0:7.5.1-24.el8_10`
`frr-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:7.5.1-24.el8_10`
`frr-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:7.5.1-24.el8_10`
`frr-selinux` Red Hat:enterprise_linux:8::appstream	All versions	`0:7.5.1-24.el8_10`
`frr` Red Hat:enterprise_linux:9::appstream	All versions	`0:8.5.3-13.el9_8`
`frr-debuginfo` Red Hat:enterprise_linux:9::appstream	All versions	`0:8.5.3-13.el9_8`
`frr-debugsource` Red Hat:enterprise_linux:9::appstream	All versions	`0:8.5.3-13.el9_8`
`frr-selinux` Red Hat:enterprise_linux:9::appstream	All versions	`0:8.5.3-13.el9_8`
`frr` Rocky Linux:8	All versions	`0:7.5.1-24.el8_10`
`frr` Rocky Linux:9	All versions	`0:8.5.3-13.el9_8`

Products include Frrouting Frrouting.

How do I fix CVE-2026-37457?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-37457 being exploited?

There is no known exploitation of CVE-2026-37457 in the wild and no public exploit code.

Sources

Also known as ALSA-2026:24340, ALSA-2026:24371, AZL-85646, CLSA-2026-1781101738, CLSA-2026-1781626852, DEBIAN-CVE-2026-37457 and 6 more.