Skip to content
Fencer Vulns
medium 6.1

CVE-2026-119776 json

frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses

published 2026-11-04 5 d ago modified 2026-11-04 4 d ago also EUVD-2026-116915

cvss
6.1
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 33%
public exploits
0
none known

Summary

In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks.

Note the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked.

Required configuration: The OSPFv3 for IPv6 routing protocol must be running (ospf6d process) and in use (enabled globally with "router ospf6" and on specific interfaces with "ipv6 ospf6 area".)

Workaround: either:

* configure OSPFv3 authentication trailers ("ipv6 ospf6 authentication") * or ensure through firewall configuration that only packets with link-local or multicast destination addresses are accepted on input for IPv6 protocol 89 (OSPF). Note that checking the source address is insufficient, as some routers may (unexpectedly) forward packets with global-scoped IPv6 destination addresses even if they have link-local source addresses.

Patch / fix

  • frr Debian 14 10.7.1-7

debian advisories DEBIAN-CVE-2026-119776

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-119776 updated cvss 7.7

frr: frr: Unauthorized routing adjacency establishment via missing OSPFv3 address validation

  • Red Hat Fast Datapath for RHEL 9 frr-selinux, frr 10.7.1-3.el10fdp Red Hat Fast Datapath for RHEL 10 frr-selinux, frr 10.7.1-3.el10fdp Red Hat Enterprise Linux 8 frr, frr-contrib, frr-selinux, frr 10.7.1-3.el10fdp Red Hat Enterprise Linux 9 frr, frr10, frr-selinux, frr10-selinux, frr 10.7.1-3.el10fdp Red Hat Enterprise Linux 10 frr 10.7.1-3.el10fdp
    affected: workaround, no fix available

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y
CNA 4.0 6.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X

Affected products

  • frrouting frrouting

Classification

Weakness
  • CWE-304 Missing Critical Step in Authentication

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.