PatchTheCVECVE-2017-5495: All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vt
CVE-2017-5495 is a high-severity flaw (CVSS 7.5) affecting quagga. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Q
Why this priority
- High severity
- EPSS top 3%: very likely to be exploited
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 18.8% (top 3%) |
| CISA exploited list | No |
| Weakness | CWE-119 |
| Published | 2017-01-24 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-5495?
quagga: upgrade to newer than 1.1.0. Exact commands for each OS are on this page.
Is CVE-2017-5495 being exploited?
CVE-2017-5495 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-5495 affect?
CVE-2017-5495 affects quagga. Severity is high (CVSS 7.5). All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their t
How urgent is CVE-2017-5495?
Priority 56/100. High severity; EPSS top 3%: very likely to be exploited; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2021-44038 HIGH 7.8 UPGRADE An issue was discovered in Quagga through 1.2.4
- CVE-2018-5381 MEDIUM 6.5 UPGRADE MITIGATE The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of "Capabilities" in BGP OPEN mes
- CVE-2018-5380 MEDIUM 4.3 UPGRADE MITIGATE The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables
- CVE-2018-5379 HIGH 7.5 UPGRADE MITIGATE The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UP
- CVE-2018-5378 HIGH 7.1 UPGRADE MITIGATE The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY