CVE-2017-15865: Frrouting

High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days.

bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers to obtain sensitive information via a malformed BGP UPDATE packet from a connected peer, which triggers transmission of up to a few thousand unintended bytes because of a mishandled attribute length, aka RN-690 (CM-18492).

Affected products

• Frrouting Frrouting: before 2.0.2 (fixed in 2.0.2); version 3.0 only; version 3.0.1 only

Published 2017-11-08. Last modified 2026-06-17.