CVE-2010-2948: Quagga

Medium severity, CVSS 6.5. EPSS: 4% chance of exploitation in the next 30 days.

Stack-based buffer overflow in the bgp_route_refresh_receive function in bgp_packet.c in bgpd in Quagga before 0.99.17 allows remote authenticated users to cause a denial of service (daemon crash) or possibly execute arbitrary code via a malformed Outbound Route Filtering (ORF) record in a BGP ROUTE-REFRESH (RR) message.

Affected products

• Quagga Quagga: up to and including 0.99.16; version 0.95 only; version 0.96 only; version 0.96.1 only; version 0.96.2 only; version 0.96.3 only; …

Published 2010-09-10. Last modified 2026-06-16.