CVE-2026-119776

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks. Note the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked.

CWE	CWE-304
Vendor	frrouting
Product	frrouting
Published	Nov 4, 2026
Last Updated	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for frrouting frrouting

Be the first to know when new unknown vulnerabilities affecting frrouting frrouting are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

frrouting / frrouting

0 < *

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FRRouting/frr/pull/24183/changes/eaccfcdb35bce8d94621b06633417ba3fa657f34 github.com: https://github.com/FRRouting/frr/pull/24183 github.com: https://github.com/FRRouting/frr/pull/23935

Credits

🔍 Bing Shui <[email protected]> (not reported as security issue) Anthropic OSS-scanner (re-report, ANT-2026-N0E1INIV)