[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOOJ6G0KfsMBYFtSnRb89M9oebgIFMi1ApgtZJ4_GQks":3},{"success":4,"data":5},true,{"vendor":6,"topVulnerabilitiesByEpss":27,"kevVulnerabilities":85,"topProductsByCves":86,"seoMetadata":89,"meta":98},{"vendorId":7,"vendorName":8,"productCount":9,"cveCount":10,"kevCount":11,"versionCount":12,"lastCveUpdate":13,"firstLetter":14,"products":15,"description":26},26193,"quagga",2,36,0,65,"2021-11-19","q",[16,20],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},131847,61,33,{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":11,"last_cve_update":25},131848,"quagga_routing_software_suite",4,3,"2006-05-05","Quagga is a technology vendor with 2 tracked products and 36 known security vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this vendor.",[28,37,43,49,54,59,64,71,77,81],{"cveId":29,"description":30,"publishedDate":31,"cvssScore":32,"cvssVersion":33,"severity":34,"isKev":35,"epssScore":36},"CVE-2018-5378","The Quagga BGP daemon (bgpd) prior to version 1.2.3 does not properly bounds check the data sent with a NOTIFY to a peer, if an attribute length is invalid. Arbitrary data from the bgpd process may be sent over the network to a peer and\u002For bgpd may crash.","2018-02-19",5.9,"v3.0","Medium",false,0.742,{"cveId":38,"description":39,"publishedDate":31,"cvssScore":40,"cvssVersion":33,"severity":41,"isKev":35,"epssScore":42},"CVE-2018-5379","The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and\u002For unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.",9.8,"Critical",0.38454,{"cveId":44,"description":45,"publishedDate":31,"cvssScore":46,"cvssVersion":33,"severity":47,"isKev":35,"epssScore":48},"CVE-2018-5381","The Quagga BGP daemon (bgpd) prior to version 1.2.3 has a bug in its parsing of \"Capabilities\" in BGP OPEN messages, in the bgp_packet.c:bgp_capability_msg_parse function. The parser can enter an infinite loop on invalid capabilities if a Multi-Protocol capability does not have a recognized AFI\u002FSAFI, causing a denial of service.",7.5,"High",0.30162,{"cveId":50,"description":51,"publishedDate":52,"cvssScore":46,"cvssVersion":33,"severity":47,"isKev":35,"epssScore":53},"CVE-2017-5495","All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an unbounded memory allocation in the telnet 'vty' CLI, leading to a Denial-of-Service of Quagga daemons, or even the entire host. When Quagga daemons are configured with their telnet CLI enabled, anyone who can connect to the TCP ports can trigger this vulnerability, prior to authentication. Most distributions restrict the Quagga telnet interface to local access only by default. The Quagga telnet interface 'vty' input buffer grows automatically, without bound, so long as a newline is not entered. This allows an attacker to cause the Quagga daemon to allocate unbounded memory by sending very long strings without a newline. Eventually the daemon is terminated by the system, or the system itself runs out of memory. This is fixed in Quagga 1.1.1 and Free Range Routing (FRR) Protocol Suite 2017-01-10.","2017-01-24",0.18803,{"cveId":55,"description":56,"publishedDate":57,"cvssScore":46,"cvssVersion":33,"severity":47,"isKev":35,"epssScore":58},"CVE-2017-16227","The aspath_put function in bgpd\u002Fbgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages, because AS_PATH size calculation for long paths counts certain bytes twice and consequently constructs an invalid message.","2017-10-29",0.1879,{"cveId":60,"description":61,"publishedDate":31,"cvssScore":62,"cvssVersion":33,"severity":34,"isKev":35,"epssScore":63},"CVE-2018-5380","The Quagga BGP daemon (bgpd) prior to version 1.2.3 can overrun internal BGP code-to-string conversion tables used for debug by 1 pointer value, based on input.",4.3,0.14836,{"cveId":65,"description":66,"publishedDate":67,"cvssScore":68,"cvssVersion":69,"severity":34,"isKev":35,"epssScore":70},"CVE-2010-1674","The extended-community parser in bgpd in Quagga before 0.99.18 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a malformed Extended Communities attribute.","2011-03-29",5,"v2",0.13426,{"cveId":72,"description":73,"publishedDate":74,"cvssScore":75,"cvssVersion":33,"severity":47,"isKev":35,"epssScore":76},"CVE-2016-2342","The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.","2016-03-17",8.1,0.13334,{"cveId":78,"description":79,"publishedDate":25,"cvssScore":68,"cvssVersion":69,"severity":34,"isKev":35,"epssScore":80},"CVE-2006-2223","RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly implement configurations that (1) disable RIPv1 or (2) require plaintext or MD5 authentication, which allows remote attackers to obtain sensitive information (routing state) via REQUEST packets such as SEND UPDATE.",0.1128,{"cveId":82,"description":83,"publishedDate":25,"cvssScore":68,"cvssVersion":69,"severity":34,"isKev":35,"epssScore":84},"CVE-2006-2224","RIPd in Quagga 0.98 and 0.99 before 20060503 does not properly enforce RIPv2 authentication requirements, which allows remote attackers to modify routing state via RIPv1 RESPONSE packets.",0.10358,[],[87,88],{"id":17,"product_name":8,"version_count":18,"cve_count":19,"kev_count":11,"last_cve_update":13},{"id":21,"product_name":22,"version_count":23,"cve_count":24,"kev_count":11,"last_cve_update":25},{"title":90,"metaDescription":91,"keywords":92,"structuredData":93},"Quagga - Security Vulnerabilities & Analysis | Precursor Intelligence","Comprehensive security analysis for Quagga covering 2 products with 36 tracked vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Quagga vulnerabilities, Quagga security, Quagga CVE, Quagga threat intelligence, vendor security analysis, cybersecurity threats, vulnerability management, CVE tracking",{"@context":94,"@type":95,"name":96,"description":91,"url":97},"https:\u002F\u002Fschema.org","Organization","Quagga","https:\u002F\u002Fprecursorintelligence.com\u002Fvendors\u002Fquagga",{"totalProducts":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":13,"generatedAt":99,"apiVersion":100},"2026-10-18T18:50:31.010Z","3.0"]