VyOS 1.5.1 and 1.4.5 LTS released: security fixes, BGP enhancements, and automated upgrades

Hello, Community!

VyOS 1.5.1 and VyOS 1.4.5 LTS are both available, and subscribers can download images from the Support Portal.

Both releases are primarily security releases. They fix thirteen vulnerabilities, twelve of which are in accel-ppp — the daemon behind the PPPoE, IPoE, L2TP, and PPTP servers. Most let an unauthenticated attacker crash the service with a crafted packet, but some disclose memory contents that can include other clients’ data, credentials, and pointers, and one lets a client be authenticated without valid credentials at all. The thirteenth is a remote code execution vulnerability in the update-check mechanism. If you run any of these services, upgrade promptly. VyOS 1.4.5 additionally fixes a vulnerability in its NHRP subsystem that does not affect 1.5.1.

Beyond the security work, VyOS 1.5.1 brings a substantial set of new features and improvements, and both releases include a large number of bug fixes. Full lists are at the end of this announcement.

Early access to security fixes and updates

Every fix described in this announcement is already available. Customers with an active subscription have had them in the LTS releases since 1 August 2026, so if you have updated since then you are already covered. If you run a rolling release, update to a current build.

Arbitrary command execution through a malicious update-check server (RCE)

This is a remote code execution (RCE) vulnerability. The script behind set system update-check processed the server response in an unsafe way. If the update service were compromised, or an attacker managed to redirect a request to a server under their control through DNS poisoning or IP spoofing, that server could execute arbitrary commands by sending a crafted response.
A successful attack runs arbitrary commands on the router itself, and that means complete compromise.
Update checks are not enabled by default in any VyOS version, so most deployments are not exposed. Treat that as a configuration detail rather than a safeguard: if system update-check is set anywhere in your estate, those systems are exposed today and should be upgraded.

Multiple vulnerabilities in accel-ppp

We found and fixed twelve vulnerabilities in accel-ppp, which powers the PPPoE, IPoE, L2TP, and PPTP servers. Most let an unauthenticated attacker crash the service, which is a serious availability risk on any router terminating subscriber sessions. Two disclose memory contents, which on a busy access concentrator can include other clients’ session data, credentials, and pointers. One bypasses RADIUS authentication altogether. The set, therefore, spans service availability, the confidentiality of other subscribers’ data, and the integrity of authentication itself.

• RADIUS authentication bypass via source IP spoofing: An attacker who can send UDP packets carrying the address of a configured RADIUS server can trick accel-ppp into authenticating a client that has no valid credentials.
• Stack buffer overflow via an oversized RADIUS Accel-VRF-Name.
• Crash via an oversized Host-Uniq tag leading to a buffer overflow.
• Unvalidated PPP header length in control protocol response handlers causes heap information disclosure.
• Crash via a crafted PPPoE PADR packet without a Service-Tag.
• IPv6CP uninitialized stack memory disclosure via ipv6-peer-interface-id calling-sid.
• An SSTP zero-length packet causes an infinite CPU loop and 100% CPU load.
• An incorrect DHCPv6 Status Code option causes an accel-pppd crash through an out-of-bounds read.
• Stack buffer overflow via a RADIUS Framed-Route in an Access-Accept message.
• Crash via a crafted DHCPv6 Relay-forward packet with more nested relay layers than HOP_COUNT_LIMIT.
• Crash via a crafted DHCPv6 solicit message with multiple Rapid-Commit options.
• A correct RADIUS Response Authenticator could be erroneously treated as incorrect, tearing down the PPPoE session.

VyOS 1.5.1

VyOS 1.5.1 adds roughly thirty new features and improvements across routing, high availability, VPN, and system services. Among the more widely applicable:

• BGP now supports the asdot, asdot+, and plain ASN notation formats, along with update-delay and establish-waitparameters, and BFD strict mode.
• SNMP traps can now be configured for VRRP, and VRRP groups accept a health check timeout.
• Route maps can match EVPN route types and a source peer.
• NTP supports hardware timestamp offload and a local-stratumoption.
• Configuration differences against the config sync peer can now be inspected directly with show configuration secondary sync.

It also updates FRR to 10.5, and fixes a number of VPP issues, including ACLs on VLAN sub-interfaces, interface removal, core allocation and CPU isolation behavior, and an unhandled exception when enabling VPP on XCP-ng.

VyOS 1.4.5

Insufficient validation of NHRP error indication packets

We found and fixed a vulnerability in OpenNHRP that lets an unauthenticated remote attacker forge Error Indication packets. Forged packets make it possible to:

• Bypass authentication completely, with no token required.
• Cancel pending NHRP requests, which are matched by a predictable request_id.
• Inject negative cache entries, blocking legitimate resolution for three minutes.
• Prevent spoke registration with the hub.

This vulnerability exists only in VyOS 1.4.x. VyOS 1.5.1 uses NHRPD from FRR rather than OpenNHRP, which is a completely different implementation and is not affected.
VyOS 1.4.5 also fixes an OpenNHRP crash and infinite loop triggered by an invalid NHRP Extension Type.

VyOS 1.4.x has entered maintenance mode

VyOS 1.4.x (Sagitta) is now in maintenance mode. It will continue to receive fixes for significant bugs and for security vulnerabilities, but it will no longer receive feature backports.

Configuration syntax changes in both versions

Both releases change two configuration items, and both changes are applied automatically by migration scripts. No manual action is required.

• The outdated and no longer supported cipher name rijndael-cbc@lysator.liu.se is replaced with aes-256-cbc, which avoids configuration loading errors (T8098).
• Firewall group names containing characters outside [a-zA-Z0-9_\-\.] are normalized (T8282).

Full list of changes — VyOS 1.5.1

Other issues

• Squid is updated from the now-unmaintained 5.x to 7.6 (T9058).

Configuration syntax changes

• The cipher name rijndael-cbc@lysator.liu.se is replaced with aes-256-cbc (T8098).
• Firewall group names outside [a-zA-Z0-9_\-\.] are normalized (T8282).

New features and improvements

• It is now possible to configure SNMP traps for VRRP (T8448):

set high-availability vrrp snmp set service snmp trap-source '10.0.0.1' set service snmp trap-target 10.0.0.2 community 'public'

• set high-availability virtual-server persistence-timeout can now be set to zero to disable connection persistence (T7059).
• set service ssh now runs sshd -t as a commit safety check (T8090).
• There is now support for more LCD screens (T8213).
• VXLAN TTL is set to 64 by default instead of 16 (T8222).
• BGP now supports ASN notation format options: parameters as-notation <asdot|asdot+|plain></asdot|asdot+|plain> (T7338).
• The PPPoE server now provides an any-login option to allow any client to connect without authentication, for testing (T5710).
• run show interfaces wireguard wgX summary now includes the peer name in its output (T4833).
• set pki certificate acme listen-address now supports IPv6 addresses (T6368).
• The conntrack sync purge timeout is now configurable with set service conntrack-sync purge-timeout (T8189).
• The commit archive now supports VRF: set system config-management commit-archive vrf (T4732).
• There are now commands for viewing configuration differences with the config sync peer: show configuration secondary sync [commands] [running | candidate | saved] [] (T7784).
• It is now possible to explicitly configure the boot console device: set system console device kernel (T8375).
• MAC address learning can now be disabled on bridge interfaces with set interfaces bridge brX member interface disable-learning (T8411).
• It is now possible to set a VRF for the Zabbix agent: set service monitoring zabbix-agent vrf (T5657).
• A health check timeout can now be set in VRRP: set high-availability vrrp group health-check timeout (T8293).
• Route maps now support matching EVPN route types: set policy route-map rule 1 match evpn route-type (T8589).
• Route maps now support a source peer option (T8588).
• Container networks now support user-defined MAC addresses: set container name network mac (T7863).
• BGP parameters now support update-delay and establish-wait (T8607).
• BFD now supports strict mode: set protocols bgp neighbor bfd strict hold-time (T8822).
• The FRR watchdog timeout can now be set explicitly with set system frr watchfrr-timeout (T8606).
• The DHCP server now has a log verbosity option: set service dhcp-server log-level (T8600).
• NTP now supports hardware timestamp offload: set service ntp offload timestamp interface (T6630).
• The NTP server now has a local-stratum option (T8601).
• The OpenConnect server now supports executing connection scripts: set vpn openconnect script connect (T7654).
• The IPoE server now supports an idle-timeout option (T8910).
• Interfaces and other node-unique paths are now automatically excluded from config sync (T8502).
• The conntrack table now has per-flow counters and a VRF filter (T8308).

Bug fixes

• VPP interfaces are no longer erroneously allowed to be members of kernel bridge or bonding interfaces (T8419).
• VPP ACLs can now be correctly applied to VLAN sub-interfaces (T8495).
• Fixed an issue with interface removal from VPP configuration (T8438).
• Fixed an issue with VPP core allocation and CPU isolation behavior (T8460).
• Fixed an unhandled exception when enabling VPP on XCP-ng (T8930).
• Custom ports for the Telegraf Loki plugin work correctly now (T8229).
• Abbreviated weekday names such as Mon or Sat work correctly in firewall rules again (T8275).
• run show console-server * commands no longer throw errors when run while the service is not configured (T6808).
• NAT64 now correctly checks port range availability (T8456).
• Option 67 (boot file name) works correctly in the DHCP server again (T8408).
• Fixed an error in the migration of VyOS 1.4 DHCP server configurations (T8586).
• Fixed an issue with prefix validation in the NDP proxy (T8292).
• Automatic GeoIP data update works correctly again (T8459).
• run show history works correctly from configuration mode now (T8479).
• The output of run show dhcp server leases can now be correctly sorted by time remaining (T8493).
• Multi-port USB-to-serial adapters work correctly in the console server now (T8211).
• Flow table offload works correctly with the zone-based firewall again (T8446).
• Traceroute commands now work correctly with IPv6 source addresses (T8539).
• Fixed an issue with the migration of OpenVPN certificates from VyOS 1.3.x configurations (T8280).
• run show isis neighbor system-id works correctly now (T8305).
• DHCP relay now warns if it is configured to use an interface that does not exist (T7879).
• Flushing WAN load balancing connections no longer affects unrelated conntrack entries (T8481).
• set system option performance no longer overrides sysctl settings set by the firewall (T6933).
• HAProxy now checks listen-address for port conflicts with other services rather than treating any process on the port as a conflict (T7928).
• WWAN interfaces now work correctly with the Huawei ME906s-158 and related devices (T8924).
• Commit no longer fails when a wireless modem is absent or not connected (T8412).
• Changing PPPoE server RADIUS settings works correctly now (T8883).
• The SNMP engineBoots counter is now correctly preserved across reboots (T8538).
• A change to the OpenVPN server that only affects data in the client configuration directory no longer causes a service restart (T6478).
• Fixed an issue with IPsec log levels not being respected by journald (T8912).
• Fixed a false positive port availability check failure whenit  service https is used with a VRF (T8454).
• Fixed an unhandled exception when removing NAT66 rules from the configuration (T8939).
• Password reset now works correctly with passwords set by cloud-init (T8346).
• Fixed an issue with missing X.509 extensions in generated CRLs (T8492).
• Fixed an issue in the password reset script that could corrupt other accounts (T8985).
• run show system commit diff works correctly again (T8981).
• Fixed multiple typos in various messages (T8490).

Internal changes

• FRR updated to 10.5 (T7664).

Full list of changes — VyOS 1.4.5

Release lifecycle changes

• VyOS 1.4.x (Sagitta) has entered maintenance mode.

Other issues

• Squid is updated from the now-unmaintained 5.x to 7.6 (T9058).

Issues already addressed by hotfix releases

• A remote attacker can execute arbitrary code via a specially crafted DDNS update message.

Configuration syntax changes

• The cipher name rijndael-cbc@lysator.liu.se is replaced with aes-256-cbc (T8098).
• Firewall group names outside [a-zA-Z0-9_\-\.] are normalized (T8282).

New features and improvements

• The conntrack sync purge timeout is now configurable with set service conntrack-sync purge-timeout (T8189).
• IPv6 RA prefixes can now be derived automatically from a base interface address: service router-advert interface prefix ::/64 base-interface (T8302).
• It is now possible to configure SNMP traps for VRRP (T8448):

set high-availability vrrp snmp set service snmp trap-source '10.0.0.1' set service snmp trap-target 10.0.0.2 community 'public'

• set high-availability virtual-server persistence-timeout can now be set to zero to disable connection persistence (T7059).
• set service ssh now runs sshd -t as a commit safety check (T8090).
• There is now support for more LCD screens (T8213).
• ikev2-reauth is now implemented for site-to-site IPsec peers (T7555).

Bug fixes

• A change to the OpenVPN server that only affects data in the client configuration directory no longer causes a service restart (T6478).
• Fixed an error with creating bonding interfaces on AWS (T8084).
• Fixed an output format problem in run show interfaces kernel(T7741).
• The completion for set interfaces bonding bondX member interface no longer erroneously shows VLAN sub-interfaces (T8110).
• Attempts to configure non-existent Ethernet interfaces now cause normal commit errors rather than unhandled exceptions (T8142).
• IPv6 autoconfiguration works correctly on PPPoE interfaces again (T8153).
• IS-IS lsp-refresh-interval correctly accepts all allowed values now (T8158).
• Dynamic prefix assignment mode is no longer erroneously enabled for IPsec tunnels (T8022).
• Fixed a false positive where add system image warned about unsaved changes when there were none (T8177).
• Syslog no longer freezes when a log file reaches 512KB (T7756).
• Fixed an issue with dynamic DNS options migration (T7924).
• Fixed an issue that could lead to configuration data corruption on power loss or similar abrupt restarts (T7836).
• Fixed a bug that could make the installer script fail to see previous installations (T7994).
• IGMP proxy service restart works correctly now (T8295).
• VRF interface names containing non-alphanumeric characters now correctly raise a commit error (T8320).
• The OSPF virtual-link option no longer accepts invalid values (T8319).
• Fixed an issue that could prevent OSPF plaintext authentication from working (T7679).
• Fixed an issue that could result in missing configuration on upgrade from VyOS 1.3.x (T8279).
• Fixed an error when the IPv6 firewall recent option was configured (T8383).
• Fixed an issue that allowed disabled users in the PPPoE server and remote access services to still connect (T8385).
• The bridge port priority option works correctly now (T8388).
• The firewall option add-address-to-group destination-group works correctly again (T8387).
• Changing the source interface of a MACsec interface works correctly again (T8397).
• The IS-IS and OpenFabric MD5 authentication option no longer causes spurious commit errors (T8389).
• The remote access IPsec local port option works correctly again (T8386).
• Fixed an unhandled exception in the EUI-64 value validator (T8384).
• Static IPv4 addresses are no longer erroneously removed by the DHCP client if both exist on the same interface (T8188).
• Fixed an error in configuration migration when protocol all and port-group were present in the same firewall rule (T8277).
• Fixed an issue with configuration file permissions that could interfere with cloud-init (T8418).
• Completion for the pseudo-ethernet interface source-interface option now correctly shows bridge and bonding interfaces (T8434).
• Custom ports for the Telegraf Loki plugin work correctly now (T8229).
• Fixed an error when modifying SRv6 prefix option values (T7968).
• Abbreviated weekday names such as Mon or Sat work correctly in firewall rules again (T8275).
• DHCPv6 server configuration now correctly detects and disallows overlapping subnets (T8399).
• Fixed an error in firewall configuration migrations when source or destination addresses are not valid IP addresses (T8281).
• DMVPN no longer fails if the local address is not yet available when it loads (T8228).
• Fixed an issue with IPsec log levels not being respected by journald (T8912).
• Multi-port USB-to-serial adapters work correctly in the console server now (T8211).
• run show history works correctly from configuration mode now (T8479).
• Fixed an issue with the migration of OpenVPN certificates from VyOS 1.3.x configurations (T8280).
• run show isis neighbor system-id works correctly now (T8305).
• DHCP relay now warns if it is configured to use an interface that does not exist (T7879).
• set system option performance no longer overrides sysctl settings set by the firewall (T6933).
• HAProxy now checks listen-address for port conflicts with other services rather than treating any process on the port as a conflict (T7928).
• WWAN interfaces now work correctly with the Huawei ME906s-158 and related devices (T8924).
• Commit no longer fails when a wireless modem is absent or not connected (T8412).
• The WireGuard fwmark option works correctly with VRFs again (T8905).
• The SNMP engineBoots counter is now correctly preserved across reboots (T8538).
• Fixed a false positive port availability check failure when service https is used with a VRF (T8454).
• Fixed an unhandled exception when removing NAT66 rules from the configuration (T8939).
• Password reset now works correctly with passwords set by cloud-init (T8346).
• Fixed an issue in the password reset script that could corrupt other accounts (T8985).
• Fixed an issue with missing X.509 extensions in generated CRLs (T8492).
• Fixed an issue that could lead to erroneous commit errors when the PPPoE client is configured with IPv6 (T8404).
• Fixed an issue with the migration of dynamic DNS configurations from older versions (T6950).
• Changing PPPoE server RADIUS settings works correctly now (T8883).
• run show system commit diff works correctly again (T8981).
• Fixed syslog configuration file rendering issues in set system syslog file (T9050, T9055, T9056).
• set service router-advert interface name-server-lifetime 0 is no longer erroneously rejected as incorrect (T9084).
• Fixed a race condition on wireless interface removal (T9104).
• Fixed a routing issue in WAN load balancing (T8480).
• Fixed an issue with validating the prefix list le and ge options (T8823).
• show pki certificate private pem shows the private keys of certificates stored in files (T8877).
• Fixed multiple typos in various messages (T8490).
  
  

Download the Datasheet