frrouting has 3 CVEs on record. 2 were published in the last 90 days. The median CVSS is 6.5 (medium). Most affected products: FRRouting (2), frr (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 2 prev 0
Worst active — by depth score
CVE-2022-42917Medium· 6.7In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the owner…37CVE-2026-28532Medium· 6.5FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions36CVE-2026-119776Medium· 6.1frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses34
frrouting vulnerabilities
CVEs affecting frrouting, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-119776Medium· 6.1frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses
In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups…
CVE-2022-42917Medium· 6.7In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the owner…
In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the owner…
CVE-2026-28532Medium· 6.5FRRouting < 10.5.3 Integer Overflow in OSPF TLV Parser Functions
FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macr…