Frrouting vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2025-61107 FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c.High 7.5 · Oct 28, 2025
• CVE-2025-61106 FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c.High 7.5 · Oct 28, 2025
• CVE-2025-61104 FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_unknown_tlv function at ospf_ext.c.High 7.5 · Oct 28, 2025
• CVE-2025-61103 FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_lan_adj_sid function at ospf_ext.c.High 7.5 · Oct 28, 2025
• CVE-2025-61105 FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_link_info function at ospf_ext.c.High 7.5 · Oct 27, 2025
• CVE-2025-61102 FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_adj_sid function at ospf_ext.c.High 7.5 · Oct 27, 2025
• CVE-2025-61101 FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_link_rmt_itf_addr function at ospf_ext.c.High 7.5 · Oct 27, 2025
• CVE-2025-61100 FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the ospf_opaque_lsa_dump function at ospf_opaque.c.High 7.5 · Oct 27, 2025
• CVE-2025-61099 FRRouting/frr from v2.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the opaque_info_detail function at ospf_opaque.c.High 7.5 · Oct 27, 2025
• CVE-2024-44070 An issue was discovered in FRRouting (FRR) through 10.1.High 7.5 · Aug 18, 2024
• CVE-2024-34088 In FRRouting (FRR) through 9.1, it is possible for the get_edge() function in ospf_te.c in the OSPF daemon to return a NULL pointer.High 7.5 · Apr 30, 2024
• CVE-2023-38407 bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.High 7.5 · Nov 6, 2023
• CVE-2023-38406 bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."Critical 9.8 · Nov 6, 2023
• CVE-2023-47235 An issue was discovered in FRRouting FRR through 9.0.1.High 7.5 · Nov 3, 2023
• CVE-2023-47234 An issue was discovered in FRRouting FRR through 9.0.1.High 7.5 · Nov 3, 2023
• CVE-2023-41909 An issue was discovered in FRRouting FRR through 9.0.High 7.5 · Sep 5, 2023
• CVE-2023-38802 FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attributeHigh 7.5 · Aug 29, 2023
• CVE-2023-41361 An issue was discovered in FRRouting FRR 9.0.Critical 9.8 · Aug 29, 2023
• CVE-2023-41360 An issue was discovered in FRRouting FRR through 9.0.Critical 9.1 · Aug 29, 2023
• CVE-2023-41359 An issue was discovered in FRRouting FRR through 9.0.Critical 9.1 · Aug 29, 2023
• CVE-2023-41358 An issue was discovered in FRRouting FRR through 9.0.High 7.5 · Aug 29, 2023
• CVE-2023-31490 An issue found in Frrouting bgpd v.8.4.2 allows a remote attacker to cause a denial of service via the bgp_attr_psid_sub() function.High 7.5 · May 9, 2023
• CVE-2022-36440 A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function.High 7.5 · Apr 3, 2023
• CVE-2022-37032 An out-of-bounds read in the BGP daemon of FRRouting FRR before 8.4 may lead to a segmentation fault and denial of service.Critical 9.1 · Sep 19, 2022
• CVE-2022-37035 An issue was discovered in bgpd in FRRouting (FRR) 8.3.High 8.1 · Aug 2, 2022