Bug 2464230 (CVE-2026-28532)

Summary: CVE-2026-28532 FRRouting: frr: FRRouting: Denial of Service due to integer overflow in OSPF TLV parser functions
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in FRRouting. An integer overflow vulnerability exists in several OSPF Traffic Engineering and Segment Routing TLV parser functions. An attacker with an established OSPF (Open Shortest Path Path First) adjacency can send a specially crafted LS (Link State) Update packet containing a malicious Type 10 or Type 11 Opaque LSA (Link State Advertisement). This can trigger out-of-bounds memory reads, leading to a Denial of Service (DoS) by crashing all affected routers within the OSPF area or autonomous system.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-04-30 21:01:33 UTC 
FRRouting before 10.5.3 contains an integer overflow vulnerability in seven OSPF Traffic Engineering and Segment Routing TLV parser functions where a uint16_t accumulator variable truncates uint32_t values returned by the TLV_SIZE() macro, causing the loop termination condition to fail while pointer advancement continues unchecked. Attackers with an established OSPF adjacency can send a crafted LS Update packet with a malicious Type 10 or Type 11 Opaque LSA to trigger out-of-bounds memory reads and crash all affected routers in the OSPF area or autonomous system.