CVE-2026-5107
Publication date 30 March 2026
Last updated 16 April 2026
Ubuntu priority
Description
A vulnerability has been found in FRRouting FRR up to 10.5.1. This affects the function process_type2_route of the file bgpd/bgp_evpn.c of the component EVPN Type-2 Route Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is reported as difficult. The identifier of the patch is 7676cad65114aa23adde583d91d9d29e2debd045. To fix this issue, it is recommended to deploy a patch.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| frr | 25.10 questing |
Fixed 10.4.1-3ubuntu1.2
|
| 24.04 LTS noble |
Fixed 8.4.4-1.1ubuntu6.6
|
|
| 22.04 LTS jammy |
Fixed 8.1-1ubuntu1.15
|
|
| 20.04 LTS focal |
Fixed 7.2.1-1ubuntu0.2+esm4
|
|
| quagga | 25.10 questing | Not in release |
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release | |
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialNotes
Patch details
| Package | Patch details |
|---|---|
| frr |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
4.2 · Medium
|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | Low |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | Low |
| Availability impact | Low |
| Vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
References
Related Ubuntu Security Notices (USN)
- USN-8175-1
- FRR vulnerability
- 15 April 2026