An out-of-bounds write vulnerability in the FRRouting routing software allows remote attackers to trigger a denial of service condition.

This is an off-by-one out-of-bounds write vulnerability residing in the bgp_flowspec_op_decode function within bgpd/bgp_flowspec_util.c, which can be triggered by an unauthenticated attacker supplying a crafted FlowSpec component.

A successful exploitation of this vulnerability results in service disruption, potentially causing critical routing infrastructure to crash. With a CVSS score of 7.5, the severity is high due to the potential for complete loss of routing protocol availability, which can isolate network segments and impact business operations.

Immediate Action: Apply the upstream patch referenced in commit 0e6882bc72c0278988a47b2f0f73b7a91099a25c or update to the latest patched version provided by the vendor.

Proactive Monitoring: Monitor BGP daemon stability, process crash logs, and system resource utilization for unusual anomalies indicative of a crash loop.

Compensating Controls: Restrict BGP peer connections using access control lists and firewall rules to trusted routers only, thereby reducing the attack surface.

Public Exploit Available: No - there is no confirmation of a public exploit in the available data.

Network administrators managing FRRouting deployments must prioritize applying the available source code patch or vendor update immediately. Securing BGP peering sessions and ensuring monitoring tools are active will help maintain infrastructure resilience against potential denial of service attacks.