Back to Security Advisories

Frr Security Update — AlmaLinux 10 (ALSA-2026:24347)

ALSA-2026:24347 updates FRRouting (FRR) on AlmaLinux 10, fixing CVE-2026-37457 and CVE-2026-37459 — denial-of-service flaws in the routing daemon that manages BGP, OSPF, ISIS, RIP and other protocols. Update with dnf update frr and restart the frr service; routing daemons sit on every edge and core network path.

High 7.5 CVSS
AlmaLinux 10

What this means under a SharedLicense license

DoS flaws in a routing daemon let crafted protocol messages destabilize route tables — taking down connectivity for every network behind the affected router, not just the daemon itself.

Type:

security

Severity:

important

Release date:

2026-11-05

Description:

FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD.

Security Fix(es):

* frr: denial of service via crafted FlowSpec component (CVE-2026-37457)
* frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 frr-10.4.4-1.el10_2.aarch64.rpm d8dea90b674adf3240c12570a505c5dc2e341d172f06e2cec2970c6bddb126d2
noarch frr-selinux-10.4.4-1.el10_2.noarch.rpm e52027fd1714316b10d57ad6d1986270e9103048cce6f181fddac53f9ff01c8c
ppc64le frr-10.4.4-1.el10_2.ppc64le.rpm 22b4c2be070dc364181191375b5f3a5b78f4b499e66eab4a78253c6685ef481f
s390x frr-10.4.4-1.el10_2.s390x.rpm 491a695523827486e85e428a4b82850d98305282e87087383bc9a4d0e9eb398a
x86_64 frr-10.4.4-1.el10_2.x86_64.rpm 542f005238edd18c9a8ac8a2937b0f88923df4371a986540ae12d968ce75a492
x86_64_v2 frr-10.4.4-1.el10_2.x86_64_v2.rpm 99818b38a23fb5870031a9ee3634dac0c8cd4d7f77569a57ddce43f327acb2e9

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is ALSA-2026:24347?
It is AlmaLinux's FRRouting erratum for AlmaLinux 10, fixing CVE-2026-37457 and CVE-2026-37459 — denial-of-service vulnerabilities in the FRR routing daemon (BGP4, OSPFv2/v3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP, BFD support).
Who is affected?
AlmaLinux 10 servers running FRR — edge routers, core switches running routing daemons, and any network appliance built on FRRouting.
How do I apply the fix?
Run dnf update frr and restart the frr service; verify routes reconverge correctly after the restart before returning the node to production.
Why do routing daemon flaws rate Important?
Because the blast radius is the network, not one host — a crashed or destabilized routing daemon drops connectivity for every prefix the router announces.

References

Security Advisories

Related Advisories

Php Security Update — AlmaLinux 10 (ALSA-2026:23388)

2026-11-05

Php8.4 Security Update — AlmaLinux 10 (ALSA-2026:22649)

2026-11-05

Kernel Security Update — AlmaLinux 10 (ALSA-2026:95367)

2026-11-05

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System