SUSE-SU-2026:2457-1

HIGH7.5

Security update for frr

Published Jun 18, 2026

Modified 4 days ago

Fix available

Details

Description of the patch:

This update for frr fixes the following issue:

CVE-2026-5107: Fixed an improper access controls in EVPN Type-2 Route Handler (bsc#1261013).
CVE-2026-28532: Harden TE/SR TLV iteration against malformed lengths (bsc#1263859).
CVE-2026-37457: Fix off-by-one error in FlowSpec operator array bounds check (bsc#1263863).
CVE-2026-37458: Validate MP_REACH_NLRI attribute against incorrect next-hop (bsc#1263974).

Affected Packages

frr

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Server Applications 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

10.2.6-150700.3.10.1

frr-devel

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Server Applications 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

10.2.6-150700.3.10.1

libfrr0

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Server Applications 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

10.2.6-150700.3.10.1

libfrr_pb0

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Server Applications 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

10.2.6-150700.3.10.1

libfrrcares0

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Server Applications 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

10.2.6-150700.3.10.1

libfrrfpm_pb0

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Server Applications 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

10.2.6-150700.3.10.1

libfrrospfapiclient0

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Server Applications 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

10.2.6-150700.3.10.1

libfrrsnmp0

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Server Applications 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

10.2.6-150700.3.10.1

libfrrzmq0

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Server Applications 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

10.2.6-150700.3.10.1

libmgmt_be_nb0

SUSE Linux Enterprise High Performance Computing 15 SP7SUSE Linux Enterprise Module for Server Applications 15 SP7SUSE Linux Enterprise Server 15 SP7SUSE Linux Enterprise Server for SAP Applications 15 SP7

Fixed in:

10.2.6-150700.3.10.1

References

https://bugzilla.suse.com/1261013

https://bugzilla.suse.com/1263859

https://bugzilla.suse.com/1263863

https://bugzilla.suse.com/1263974

https://lists.suse.com/pipermail/sle-security-updates/2026-June/026831.html

https://www.suse.com/security/cve/CVE-2026-28532/

https://www.suse.com/security/cve/CVE-2026-37457/

https://www.suse.com/security/cve/CVE-2026-37458/

https://www.suse.com/security/cve/CVE-2026-5107/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2026/suse-su-20262457-1/

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Upstream

CVE-2026-28532 CVE-2026-37457 CVE-2026-37458 CVE-2026-5107

Ecosystems

SUSE Linux Enterprise High Performance Computing 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 15 SP7 SUSE Linux Enterprise Server for SAP Applications 15 SP7

Timeline

PublishedJun 18, 2026

ModifiedJun 18, 2026

SUSE-SU-2026:2457-1 | Mondoo Vulnerability Intelligence