A denial-of-service vulnerability (CVE-2026-37457, CVSS 7.5 HIGH) in FRRouting allows an attacker to crash the service via a crafted FlowSpec component. The NVD lists FRRouting version 10.0 as affected, but the specific patched version number is not provided in the advisory. Red Hat has released updates for FRR in RHEL 8 to address this issue.
Red Hat Product Errata RHSA-2026:24340 - Security Advisory Issued: 2026-06-08 Updated: 2026-06-08 RHSA-2026:24340 - Security Advisory Overview Updated Packages Synopsis Important: frr security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for frr is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. Security Fix(es): frr: denial of service via crafted FlowSpec component (CVE-2026-37457) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2464548 - CVE-2026-37457 frr: denial of service via crafted FlowSpec component CVEs CVE-2026-37457 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM frr-7.5.1-24.el8_10.src.rpm SHA-256: f78f3ba1f5e21d0332f4b4c8f5c5aefba39fc84ffd4f2256cfe2dc99067bb957 x86_64 frr-7.5.1-24.el8_10.x86_64.rpm SHA-256: 644e56d00cebf2adaaed1e3206af29b2a7791ed981d676e6f948858e5d56878d frr-debuginfo-7.5.1-24.el8_10.x86_64.rpm SHA-256: 308743d6035b134ced5fad991136d8039a404ad4df7eecf2c1a17a59c1935f2e frr-debugsource-7.5.1-24.el8_10.x86_64.rpm SHA-256: 91802ea4b3b05e772a72b9414213629cecb7e4bc31e8a55e22036d1f81650a58 frr-selinux-7.5.1-24.el8_10.noarch.rpm SHA-256: b64a916d30f5f17748ea3de0c19fc50a295745812f71c178ac3bf595c26061b3 Red Hat Enterprise Linux for IBM z Systems 8 SRPM frr-7.5.1-24.el8_10.src.rpm SHA-256: f78f3ba1f5e21d0332f4b4c8f5c5aefba39fc84ffd4f2256cfe2dc99067bb957 s390x frr-7.5.1-24.el8_10.s390x.rpm SHA-256: 2bb8edce4b2b1413bb955bcc14565f386f02b2996ee213a4f3d23558e06bc96f frr-debuginfo-7.5.1-24.el8_10.s390x.rpm SHA-256: dd279d14b000b0c09a919c5ec505d8f7af287c3483b5d23c5dc174db06ea53cb frr-debugsource-7.5.1-24.el8_10.s390x.rpm SHA-256: 9b39a85483ec1eb90d18a1469856570bcdd6d76afc500825da0ed67c7a4ee73a frr-selinux-7.5.1-24.el8_10.noarch.rpm SHA-256: b64a916d30f5f17748ea3de0c19fc50a295745812f71c178ac3bf595c26061b3 Red Hat Enterprise Linux for Power, little endian 8 SRPM frr-7.5.1-24.el8_10.src.rpm SHA-256: f78f3ba1f5e21d0332f4b4c8f5c5aefba39fc84ffd4f2256cfe2dc99067bb957 ppc64le frr-7.5.1-24.el8_10.ppc64le.rpm SHA-256: a4bf1aff026879cbe7f72b4b8cc7cd58fc6f371e89875dd1498f4ffbed9b0848 frr-debuginfo-7.5.1-24.el8_10.ppc64le.rpm SHA-256: 986a31621dc4be8a01522175e304a1167de16ca7d3167573f600578356774d05 frr-debugsource-7.5.1-24.el8_10.ppc64le.rpm SHA-256: e4d511f94e53ce10b5e542b32cc3b72ad32e21a638dcd98fdc353e83f5d59369 frr-selinux-7.5.1-24.el8_10.noarch.rpm SHA-256: b64a916d30f5f17748ea3de0c19fc50a295745812f71c178ac3bf595c26061b3 Red Hat Enterprise Linux for ARM 64 8 SRPM frr-7.5.1-24.el8_10.src.rpm SHA-256: f78f3ba1f5e21d0332f4b4c8f5c5aefba39fc84ffd4f2256cfe2dc99067bb957 aarch64 frr-7.5.1-24.el8_10.aarch64.rpm SHA-256: 36c3f26e9455c97c0de9dad13c370aa08e5ea2ac92ad9832782b7b0690c5185a frr-debuginfo-7.5.1-24.el8_10.aarch64.rpm SHA-256: da87b8b9dc41cf6d713cb0c178f558cd25c0642bbd783e21811b6a60da358695 frr-debugsource-7.5.1-24.el8_10.aarch64.rpm SHA-256: 1fae89ab87800ff74bbfda876911518fcd9814e0c91f5909013272faf1bc5b31 frr-selinux-7.5.1-24.el8_10.noarch.rpm SHA-256: b64a916d30f5f17748ea3de0c19fc50a295745812f71c178ac3bf595c26061b3 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM frr-7.5.1-24.el8_10.src.rpm SHA-256: f78f3ba1f5e21d0332f4b4c8f5c5aefba39fc84ffd4f2256cfe2dc99067bb957 x86_64 frr-7.5.1-24.el8_10.x86_64.rpm SHA-256: 644e56d00cebf2adaaed1e3206af29b2a7791ed981d676e6f948858e5d56878d frr-debuginfo-7.5.1-24.el8_10.x86_64.rpm SHA-256: 308743d6035b134ced5fad991136d8039a404ad4df7eecf2c1a17a59c1935f2e frr-debugsource-7.5.1-24.el8_10.x86_64.rpm SHA-256: 91802ea4b3b05e772a72b9414213629cecb7e4bc31e8a55e22036d1f81650a58 frr-selinux-7.5.1-24.el8_10.noarch.rpm SHA-256: b64a916d30f5f17748ea3de0c19fc50a295745812f71c178ac3bf595c26061b3 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 SRPM frr-7.5.1-24.el8_10.src.rpm SHA-256: f78f3ba1f5e21d0332f4b4c8f5c5aefba39fc84ffd4f2256cfe2dc99067bb957 aarch64 frr-7.5.1-24.el8_10.aarch64.rpm SHA-256: 36c3f26e9455c97c0de9dad13c370aa08e5ea2ac92ad9832782b7b0690c5185a frr-debuginfo-7.5.1-24.el8_10.aarch64.rpm SHA-256: da87b8b9dc41cf6d713cb0c178f558cd25c0642bbd783e21811b6a60da358695 frr-debugsource-7.5.1-24.el8_10.aarch64.rpm SHA-256: 1fae89ab87800ff74bbfda876911518fcd9814e0c91f5909013272faf1bc5b31 frr-selinux-7.5.1-24.el8_10.noarch.rpm SHA-256: b64a916d30f5f17748ea3de0c19fc50a295745812f71c178ac3bf595c26061b3 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 SRPM frr-7.5.1-24.el8_10.src.rpm SHA-256: f78f3ba1f5e21d0332f4b4c8f5c5aefba39fc84ffd4f2256cfe2dc99067bb957 ppc64le frr-7.5.1-24.el8_10.ppc64le.rpm SHA-256: a4bf1aff026879cbe7f72b4b8cc7cd58fc6f371e89875dd1498f4ffbed9b0848 frr-debuginfo-7.5.1-24.el8_10.ppc64le.rpm SHA-256: 986a31621dc4be8a01522175e304a1167de16ca7d3167573f600578356774d05 frr-debugsource-7.5.1-24.el8_10.ppc64le.rpm SHA-256: e4d511f94e53ce10b5e542b32cc3b72ad32e21a638dcd98fdc353e83f5d59369 frr-selinux-7.5.1-24.el8_10.noarch.rpm SHA-256: b64a916d30f5f17748ea3de0c19fc50a295745812f71c178ac3bf595c26061b3 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 SRPM frr-7.5.1-24.el8_10.src.rpm SHA-256: f78f3ba1f5e21d0332f4b4c8f5c5aefba39fc84ffd4f2256cfe2dc99067bb957 s390x frr-7.5.1-24.el8_10.s390x.rpm SHA-256: 2bb8edce4b2b1413bb955bcc14565f386f02b2996ee213a4f3d23558e06bc96f frr-debuginfo-7.5.1-24.el8_10.s390x.rpm SHA-256: dd279d14b000b0c09a919c5ec505d8f7af287c3483b5d23c5dc174db06ea53cb frr-debugsource-7.5.1-24.el8_10.s390x.rpm SHA-256: 9b39a85483ec1eb90d18a1469856570bcdd6d76afc500825da0ed67c7a4ee73a frr-selinux-7.5.1-24.el8_10.noarch.rpm SHA-256: b64a916d30f5f17748ea3de0c19fc50a295745812f71c178ac3bf595c26061b3 The Red Hat security contact is secalert@redhat.com . More contact details at https://access.redhat.com/security/team/contact/ .