CVE-2026-5107: A vulnerability has been found in FRRouting FRR up to 10.5.1

Routine

MEDIUM 4.2DOWNGRADE

CVE-2026-5107 is a medium-severity flaw (CVSS 4.2) affecting frrouting. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this

Why this priority

No elevated risk signals yet

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	4.2 (Medium)
Attack vector	Network (remote)
Attack complexity	High
Privileges needed	Low
User interaction	None
EPSS exploit chance	0.3% (top 79%)
CISA exploited list	No
Weakness	CWE-266, CWE-284
Published	2026-03-30
Last modified	2026-06-17

Publisher (CNA): VulDB · Vendor: frrouting

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-03-30 06:16 UTCPublished CVE record published
2026-06-17 10:58 UTCUpdated Record last modified

frrouting frrouting DOWNGRADE

Affected: 10.5.0 · 10.5.1

Fixed in: no fixed release known

Safe to downgrade to: a release before 10.5.0

1. Check installed version

apt-cache policy frrouting || rpm -q frrouting || frrouting --version

2. No fixed release: DOWNGRADE to a release before 10.5.0 (Debian / Ubuntu)

apt-cache madison frrouting sudo apt install frrouting=<VERSION_BEFORE_10.5.0> sudo apt-mark hold frrouting

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list frrouting sudo dnf downgrade frrouting-<VERSION_BEFORE_10.5.0> sudo dnf versionlock add frrouting

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-5107?

frrouting: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2026-5107 being exploited?

CVE-2026-5107 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-5107 affect?

CVE-2026-5107 affects frrouting. Severity is medium (CVSS 4.2). A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The atta

How urgent is CVE-2026-5107?

Priority 20/100. No elevated risk signals yet.

Related CVEs

CVE-2026-28532 MEDIUM 6.5 UPGRADE FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segme
CVE-2026-37457 HIGH 7.5 DOWNGRADE An off-by-one out-of-bounds write vulnerability in the bgp_flowspec_op_decode() function (bgpd/bgp_flowspec_ut
CVE-2026-37458 MEDIUM 6.5 UPGRADE Missing input validation in the MP_REACH_NLRI component of FRRouting (FRR) stable/10.0 to stable/10.6 allows a

References

← Back to latest CVEs