CVE-2026-37459

HighDDoS

Published: 04 May 2026

Published

04 May 2026

Modified

05 May 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0006 18.1th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-37459 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-37459 is an integer underflow vulnerability in FRRouting (FRR), affecting stable versions from 10.0 to 10.6. The flaw occurs when processing a crafted BGP UPDATE message, leading to a Denial of Service (DoS) condition. It has a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-400 (Uncontrolled Resource Consumption).

Remote attackers with network access to an affected FRR instance can exploit this vulnerability without authentication or user interaction. By sending a specially crafted BGP UPDATE message, they can trigger the integer underflow, causing resource exhaustion or a crash that disrupts BGP routing services and potentially impacts network availability.

The patch is available in FRR commit 693a2e02687cdc9d16501275e05136edea9650d9 on GitHub, which security practitioners should apply to vulnerable versions to mitigate the issue.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-27047

Vulnerability details

An integer underflow in FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.

CWE(s): CWE-400

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Remote unauthenticated exploitation of FRR BGP service via crafted UPDATE message directly enables T1190 (Exploit Public-Facing Application) and results in application DoS via resource exhaustion/crash, matching T1499.004 (Application or System Exploitation).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1