FRRouting (FRR) versions stable\u002f10.0 through stable\u002f10.6 suffer from missing input validation in the MP_REACH_NLRI component. An authenticated attacker can send a specially crafted UPDATE message causing the FRR process to crash or become unresponsive, resulting in a denial of service. The weakness is an improper input validation flaw that can be triggered by malformed routing protocol messages.

The affected system is FRRouting, commonly deployed on routers and routing platforms. Vulnerable releases include stable\/10.0 up to stable\/10.6. No vendor or product name is listed in the CNA data, but the software is identified as FRRouting via the GitHub references.

The CVSS score is not provided in the data, and EPSS is not available, so the exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The attack requires the attacker to authenticate to the FRRouting instance or have access to a peer capable of injecting OSPF UPDATE messages. Based on the description, it is inferred that the attack vector is network-level, leveraging OSPF MP_REACH_NLRI messages sent from an authenticated or trusted peer.