CVE-2017-16227: Debian Linux

High severity, CVSS 7.5. EPSS: 18.8% chance of exploitation in the next 30 days.

The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Quagga Quagga: up to and including 1.2.1

Published 2017-10-29. Last modified 2026-06-17.