FRRouting (FRR) implements a function rfapiRibBi2Ri() that processes BGP UPDATE messages without proper input validation. An attacker can craft a malformed BGP UPDATE packet and send it to an FRR instance, triggering a crash or memory corruption that results in a denial of service. The core weakness is an improper input validation flaw (CWE‑20), leading to availability loss for the network service.

FRRouting (FRR) stable release series 10.0 through 10.6 are affected. Any deployment of FRR within this version range that accepts BGP UPDATE messages is vulnerable.

No CVSS score is listed for this vulnerability, and the EPSS score is not available, leaving the exploitation probability uncertain. It is not currently listed in the CISA KEV catalog. Based on the description, the attack can be performed remotely by an entity with network access to the FRR instance, using crafted BGP UPDATE packets to cause an outage. Availability impact can affect network reachability and routing stability, potentially disrupting all services that rely on the affected FRR instance.