OSPFv3 Vulnerability in FRRouting Affects IPv6 Connectivity
CVE-2026-119776

6.1MEDIUM

Key Information:

Vendor

Frrouting

Status
Frrouting
Vendor
CVE Published:
4 November 2026

What is CVE-2026-119776?

The OSPFv3 implementation in FRRouting lacks checks to ensure that packets originate from link-local addresses and are directed to either link-local destinations or recognized multicast groups. This oversight can allow attackers to create OSPFv3 adjacencies from remote, potentially malicious IPv6 hosts. While the use of OSPFv3 authentication trailers can help mitigate exploitability, it may still enable attackers to engage in resource-intensive authentication checks, presenting a threat to network performance and integrity.

Affected Version(s)

frrouting 0

References

https://github.com/FRRouting/frr/pull/24183/changes/eaccf...
patch
https://github.com/FRRouting/frr/pull/24183
related
https://github.com/FRRouting/frr/pull/23935
related

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bing Shui <bingshui@smail.nju.edu.cn> (not reported as security issue)
Anthropic OSS-scanner (re-report, ANT-2026-N0E1INIV)
.