SUSE-SU-2026:2454-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2026:2454-1

HIGH7.5

Security update for frr

Published Jun 18, 2026

Modified 4 days ago

Fix available

Details

Description of the patch:

This update for frr fixes the following issues

Update to frr 8.5.7:

CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974). DoS via a crafted UPDATE message (bsc#1263974).

Affected Packages

frr

SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP5SUSE Linux Enterprise Server 15 SP5-LTSS

Fixed in:

8.5.7-150500.4.43.1

frr-devel

Fixed in:

8.5.7-150500.4.43.1

libfrr0

Fixed in:

8.5.7-150500.4.43.1

libfrr_pb0

Fixed in:

8.5.7-150500.4.43.1

libfrrcares0

Fixed in:

8.5.7-150500.4.43.1

libfrrfpm_pb0

Fixed in:

8.5.7-150500.4.43.1

libfrrospfapiclient0

Fixed in:

8.5.7-150500.4.43.1

libfrrsnmp0

Fixed in:

8.5.7-150500.4.43.1

libfrrzmq0

Fixed in:

8.5.7-150500.4.43.1

libmlag_pb0

SUSE Linux Enterprise High Performance Computing 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Server Applications 15 SP7

Fixed in:

8.5.7-150500.4.43.1

References

ADVISORY

https://bugzilla.suse.com/1261013

ADVISORY

https://bugzilla.suse.com/1263859

ADVISORY

https://bugzilla.suse.com/1263863

ADVISORY

https://bugzilla.suse.com/1263974

ADVISORY