CVE-2026-5107: 
CBL Mariner vulnerability analysis and mitigation

CVE-2026-5107 is an improper access control vulnerability in FRRouting (FRR) affecting the process_type2_route function in bgpd/bgp_evpn.c, which handles EVPN Type-2 routes. The vulnerability stems from insufficient packet validation that allows manipulation of security decisions based on untrusted inputs, leading to incorrect privilege assignment. It affects FRRouting versions up to and including 10.5.1, and was publicly disclosed on March 30, 2026 (Red Hat CVE, Feedly). The CVSS v3.1 base score is 4.2 (Medium), while the CVSS v4.0 base score is 2.3 (Low) (Feedly).

The root cause is insufficient cross-validation between the internally declared IP address length field (ipaddr_len) and the overall NLRI wire-length (psize) when parsing EVPN Type-2, Type-3, and Type-4 route NLRIs in bgpd/bgp_evpn.c and bgpd/bgp_evpn_mh.c (CWE-284: Improper Access Control; CWE-266: Incorrect Privilege Assignment; CWE-807: Reliance on Untrusted Inputs in a Security Decision). An attacker with low-privilege BGP peering access can send a crafted EVPN NLRI packet where the ipaddr_len field is inconsistent with the actual packet size, bypassing validation and causing the daemon to process malformed route entries. Additionally, the bgpd/rfapi/rfapi_rib.c component lacked guards against BGP_VNC_SUBTLV_TYPE_RFPOPTION sub-TLVs shorter than 3 bytes, which could trigger a zero-byte allocation and out-of-bounds read. The fix (commit 7676cad) adds explicit consistency checks — e.g., for Type-2: psize != 33 + (ipaddr_len/8) — across all affected route types and the rfapi path (FRR PR #21098, FRR Commit).

Successful exploitation allows an authenticated remote attacker with low privileges to modify EVPN route entries processed by the BGP daemon, compromising route integrity and potentially disrupting EVPN-based network operations. The impact is limited to low integrity and low availability effects — there is no confidentiality impact — and the scope is unchanged, meaning exploitation is confined to the affected BGP daemon instance. In environments relying on EVPN for data center or multi-tenant network overlays, route manipulation could cause traffic misdirection or service disruption (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report (Feedly). The attack requires network access, low-level authentication (BGP peering), and high complexity to execute, making opportunistic exploitation unlikely. The EPSS score is approximately 0.043% (0.000430), reflecting a very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify BGP-speaking routers running FRRouting ≤ 10.5.1 with EVPN enabled, using network scanning tools (e.g., Nmap with BGP service detection) or by leveraging existing BGP peering relationships.
2. Establish BGP peering: Obtain or abuse a low-privilege BGP peer session with the target FRR instance — this may require network-level access to the BGP port (TCP/179) and valid BGP credentials or AS configuration.
3. Craft malicious EVPN NLRI: Construct a BGP UPDATE message containing an EVPN Type-2 (MAC/IP Advertisement) NLRI where the ipaddr_len field is inconsistent with the actual NLRI psize (e.g., set ipaddr_len to a value that passes the initial 0/32/128 check but fails the psize == 33 + ipaddr_len/8 consistency check in unpatched versions).
4. Send crafted UPDATE: Transmit the malformed BGP UPDATE to the target peer. On unpatched versions, the process_type2_route function processes the inconsistent fields without rejecting them, leading to improper route handling.
5. Achieve impact: The malformed route entry is processed, potentially causing incorrect route installation, route table corruption, or reduced availability of EVPN routing functions (FRR PR #21098, FRR Commit).

• Logs: FRR BGP daemon logs (/var/log/frr/bgpd.log) showing EC_BGP_EVPN_ROUTE_INVALID error messages such as Rx EVPN Type-2 NLRI with invalid IP address length — these are generated by the patched code and their absence on unpatched systems may indicate silent processing of malformed routes.
• Network: Unexpected or malformed BGP UPDATE messages on TCP/179 from BGP peers containing EVPN NLRIs with inconsistent ipaddr_len and psize fields; unusual EVPN route advertisements from peers not expected to originate such routes.
• Process: Unexpected behavior or crashes of the bgpd process; anomalous EVPN route entries appearing in the routing table (show bgp l2vpn evpn output) with unexpected IP address fields or originating from unexpected peers.
• File System: No specific file artifacts are associated with this vulnerability, as exploitation occurs entirely within the BGP daemon's in-memory route processing.

Apply the security patch from the FRRouting project (commit 7676cad65114aa23adde583d91d9d29e2debd045, merged March 18, 2026), which has been backported to stable branches 10.0 through 10.6 (FRR PR #21098). Distribution-specific patches are available for Ubuntu (USN-8175-1), openSUSE, SUSE, and Debian, as well as Microsoft Azure Linux packages (azl3_frr_10.5.0-1, azl3_frr_10.5.0-2, cbl2_frr_8.5.5-5) (Microsoft MSRC). As a workaround where patching is not immediately possible, restrict BGP daemon access to trusted administrative peers only, implement BGP session authentication (MD5 or TCP-AO), and apply network-level ACLs to limit TCP/179 exposure.

Red Hat has published a CVE advisory tracking this issue (Red Hat CVE), and Microsoft has issued a security update guide entry covering affected Azure Linux packages (Microsoft MSRC). The FRRouting community responded promptly, with the fix submitted March 11, 2026 and merged March 18, 2026, with backports to all active stable branches completed the same day. Tenable has released Nessus detection plugins (IDs 304341 and 313695) for this vulnerability. No significant social media discussion or notable researcher commentary beyond routine CVE tracking has been observed, consistent with the vulnerability's moderate severity and high exploitation complexity.