Vulnerability-Lookup

GHSA-W6JV-W2M6-2WX3

Vulnerability from github – Published: 2026-11-04 15:32 – Updated: 2026-11-04 15:32

Details

Note the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked.

Severity

6.1 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-119776"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-304"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-04T15:17:41Z",
    "severity": "MODERATE"
  },
  "details": "In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups.  This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks.\n\n\n\nNote the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked.",
  "id": "GHSA-w6jv-w2m6-2wx3",
  "modified": "2026-11-04T15:32:31Z",
  "published": "2026-11-04T15:32:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119776"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FRRouting/frr/pull/23935"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FRRouting/frr/pull/24183"
    },
    {
      "type": "WEB",
      "url": "https://github.com/FRRouting/frr/pull/24183/changes/eaccfcdb35bce8d94621b06633417ba3fa657f34"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-119776 (GCVE-0-2026-119776)

Vulnerability from cvelistv5 – Published: 2026-11-04 14:15 – Updated: 2026-11-09 21:11

Title

frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses

Summary

In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks. Note the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked. Required configuration: The OSPFv3 for IPv6 routing protocol must be running (ospf6d process) and in use (enabled globally with "router ospf6" and on specific interfaces with "ipv6 ospf6 area".) Workaround: either: * configure OSPFv3 authentication trailers ("ipv6 ospf6 authentication") * or ensure through firewall configuration that only packets with link-local or multicast destination addresses are accepted on input for IPv6 protocol 89 (OSPF). Note that checking the source address is insufficient, as some routers may (unexpectedly) forward packets with global-scoped IPv6 destination addresses even if they have link-local source addresses.

Severity

6.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 21:10 UTC

CWE

CWE-304 - Missing critical step in authentication: protocol interactions should be limited to IPv6 link-local scope

Assigner

NetDEF CNA under the ENISA root

CNA scorecard – unranked: 1 record in the last 180 days, 10 needed details

References

3 references

URL	Tags
https://github.com/FRRouting/frr/pull/24183/chang…	patch
https://github.com/FRRouting/frr/pull/24183	related
https://github.com/FRRouting/frr/pull/23935	related

Impacted products

1 product

Vendor	Product	Version
frrouting	frrouting	Affected: 0 , < * (git) cpe:2.3:a:frrouting:frrouting::::::::

Credits

Bing Shui <bingshui@smail.nju.edu.cn> (not reported as security issue) Anthropic OSS-scanner (re-report, ANT-2026-N0E1INIV)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119776",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T21:10:58.734852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T21:11:30.420Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "modules": [
            "ospf6d"
          ],
          "product": "frrouting",
          "programFiles": [
            "ospf6d/ospf6_message.c"
          ],
          "repo": "https://github.com/FRRouting/frr/",
          "vendor": "frrouting",
          "versions": [
            {
              "changes": [
                {
                  "at": "eaccfcdb35bce8d94621b06633417ba3fa657f34",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Bing Shui \u003cbingshui@smail.nju.edu.cn\u003e (not reported as security issue)"
        },
        {
          "lang": "en",
          "type": "tool",
          "value": "Anthropic OSS-scanner (re-report, ANT-2026-N0E1INIV)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups.  This may enable malicious actors to establish OSPFv3 adjacencies from unexpectedly, distant IPv6 hosts. Proper usage of OSPFv3 authentication trailers (RFC 7166, as is best practice) prevents full exploitation of this issue, though may allow a malicious actor to waste CPU on authentication checks.\n\n\nNote the linked PR #23935 is not sufficient to fix the issue as it only verifies the source address. It is the destination address that must be checked.\n\n\nRequired configuration: The OSPFv3 for IPv6 routing protocol must be running (ospf6d process) and in use (enabled globally with\u00a0\"router ospf6\" and on specific interfaces with \"ipv6 ospf6 area\".)\n\n\nWorkaround: either:\n\n  *  configure OSPFv3 authentication trailers (\"ipv6 ospf6 authentication\")\n  *  or ensure through firewall configuration that only packets with link-local or multicast destination addresses are accepted on input for IPv6 protocol 89 (OSPF). Note that checking the source address is insufficient, as some routers may (unexpectedly) forward packets with global-scoped IPv6 destination addresses even if they have link-local source addresses."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "YES",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-304",
              "description": "CWE-304 Missing critical step in authentication: protocol interactions should be limited to IPv6 link-local scope",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T16:53:47.660Z",
        "orgId": "57a55968-44ac-464c-a794-6ba3baad09c4",
        "shortName": "NetDEF"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/FRRouting/frr/pull/24183/changes/eaccfcdb35bce8d94621b06633417ba3fa657f34"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/FRRouting/frr/pull/24183"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://github.com/FRRouting/frr/pull/23935"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "frr: ospf6d fails to enforce all OSPFv3 packets use IPv6 link-local addresses",
      "workarounds": [
        {
          "lang": "en",
          "value": "Either:\n\n  *  configure OSPFv3 authentication trailers (\"ipv6 ospf6 authentication\")\n  *  or ensure through firewall configuration that only packets with link-local or multicast destination addresses are accepted on input for IPv6 protocol 89 (OSPF). Note that checking the source address is insufficient, as some routers may (unexpectedly) forward packets with global-scoped IPv6 destination addresses even if they have link-local source addresses."
        }
      ],
      "x_generator": {
        "engine": "vim"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "57a55968-44ac-464c-a794-6ba3baad09c4",
    "assignerShortName": "NetDEF",
    "cveId": "CVE-2026-119776",
    "datePublished": "2026-11-04T14:15:32.391Z",
    "dateReserved": "2026-10-30T16:14:17.897Z",
    "dateUpdated": "2026-11-09T21:11:30.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted