CVE-2022-26128

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A buffer overflow vulnerability exists in FRRouting through 8.1.0 due to a wrong check on the input packet length in the babel_packet_examin function in babeld/message.c.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-1284

Affected software

Vendor	Product	Versions
n/a	FRRouting	through 8.1.0

References

https://github.com/FRRouting/frr/issues/10502Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html
https://github.com/FRRouting/frr/issues/10502Exploit, Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00019.html
https://lists.debian.org/debian-lts-announce/2024/09/msg00007.html

Timeline

Published: Mar 3, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-261297.8Buffer overflow vulnerabilities exist in FRRouting through 8.1.0 due to wrong checks on the subtlv length in the functions, parse_hello_subt CVE-2022-26138.8Use after free in Input in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enage in spec CVE-2022-261305.3On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions pr CVE-2022-261319.8Power Line Communications PLC4TRUCKS J2497 trailer receivers are susceptible to remote RF induced signals.CVE-2022-261339.8SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6 CVE-2022-261349.8In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attack CVE-2022-261356.5A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the si CVE-2022-261369.8A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third p CVE-2022-261378.8A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to cause additional Servlet Filters to be invoked w CVE-2022-261389.8The Atlassian Questions For Confluence app for Confluence Server and Data Center creates a Confluence user account in the confluence-users g CVE-2022-26148.8Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via CVE-2022-261439.8The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to