CVE-2024-55553
In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an…
- Risk score
- 67/100
- CVSS
- 7.5 v3.1
- Exploit chance (30 days)
- 0.8%
- Published
- 6 Jan 2025
Open in the live forecast Today's forecast
What to know
- What it is
- A vulnerability in FRRouting (FRR) before 10.3 allows an attacker to trigger re-validation of routes, potentially impacting route handling performance and causing heightened BMP traffic. This can be done by causing more than 4K updates during an update interval, which can occur organically or be triggered by an attacker.
- Affected
- {'products': ['FRRouting (FRR)'], 'packages': [], 'versions': ['< 10.3 from 6.0 onward']}
- Fix
- Upgrade to version 10.0.3, 10.1.2, 10.2.1, or >= 10.3
- Exploitation
- No known exploitation
Story map
At a glance
Canonical Ubuntu Linux: Red, act today. A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process leading to a restart, or potential…
The flaws
- CVE-2024-55553: In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an… (CVSS 7.5 · EPSS 1%)
- CVE-2026-93479: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-15176: Heap buffer overflow can lead to remote code execution (CVSS 8.1 · EPSS 1%)
- CVE-2026-97205: NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module (CVSS 8.1 · EPSS 1%)
The fix
Upgrade Canonical Ubuntu Linux: 10.3 or later on your release line
Who is exposed: {'products': ['NGINX Plus', 'NGINX Open Source'], 'packages': [], 'versions': []}
Where it stands
- No known exploitation
How it unfolded
- 26 Oct, Ubuntu security notices (official): USN-8955-1: nginx vulnerabilities
- 5 Nov, Ubuntu security notices (official): USN-7230-3: FRR regression
- 5 Nov, Ubuntu security notices (official): USN-8955-2: nginx vulnerabilities
Connects to
- Same weakness: CWE-404 (CWE-404). 11 other warnings in 30 days
- Same product: Earlier Canonical Ubuntu Linux warnings. 84 in the last 90 days
Why it is Amber
- CVSS 7.5 high
- Remotely exploitable without logging in
- Named in a government or vendor bulletin
Government and vendor bulletins
References
Original description
In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the internal socket's buffer size, default 4K on most OSes. An attacker can use this to trigger re-parsing of the RIB for FRR routers using RTR by causing more than this number of updates during an update interval (usually 30 minutes). Additionally, this effect regularly occurs organically. Furthermore, an attacker can use this to trigger route validation continuously. Given that routers with large full tables may need more than 30 minutes to fully re-validate the table, continuous issuance/withdrawal of large numbers of ROA may be used to impact the route handling performance of all FRR instances using RPKI globally. Additionally, the re-validation will cause heightened BMP traffic to ingestors. Fixed Versions: 10.0.3, 10.1.2, 10.2.1, >= 10.3.
Last activity 5 Nov 2026. Patch Forecast updates every hour.