Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-61107: FRR routing software can crash from crafted packet

CVE-2025-61107 · published 1 year ago

Summary

Versions 4.0 through 10.4.1 of FRRouting (FRR) may stop working if they receive a specially crafted network packet. This can cause a denial of service, meaning the routing service could become unavailable. Update to the latest patched version of FRR or apply the vendor’s fix to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
frrouting	frrouting	>= 4.0, <= 10.4.1 `cpe:2.3:a:frrouting:frrouting::::::::`

Original advisory text

FRRouting/frr from v4.0 through v10.4.1 was discovered to contain a NULL pointer dereference via the show_vty_ext_pref_pref_sid function at ospf_ext.c. This vulnerability allows attackers to cause ...

References

https://github.com/FRRouting/frr/pull/19480/commits/fdd957408605d4a1766225630aaf... URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61107... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-61107 Vendor Advisory
https://github.com/FRRouting/frr/issues/19471 Third Party Advisory
https://github.com/FRRouting/frr/pull/19480 Patch
https://github.com/s1awwhy/BugList/blob/main/CVE-2025-61107.md URL

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published28 Oct 2025

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2025-61107 · NVD

CVE-2025-61107 · OSV

Track software like this

Free during beta