CVE-2026-129456 frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs after a malformed attribute length from a peer

In FRRouting, bgpd accepts a Tunnel Encapsulation attribute type 23 whose outer TLV length does not match the length of the attribute: the mismatch is only logged and the attribute is processed anyway. A BGP neighbor can send UPDATE messages carrying such an attribute that put the reference count...

CVE-2026-129217

FRRouting (FRR) versions 8.3 through 10.5.1 are vulnerable to an out-of-bounds heap read and subsequent crash in the bgpd daemon. The flaw exists in the bgp_notify_decapsulate_hard_reset() function within bgpd/bgp_packet.c, which fails to validate the data field length of received BGP NOTIFICATIO...

EUVD-2026-125721

In FRRouting FRR 8.3 through 10.5.1, bgpnotifydecapsulatehardreset in bgpd/bgppacket.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message RFC 8538. When the data field is exactly one byte long, the function reads one byte past the end of a heap...

CVE-2026-120221

In FRRouting, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its...

CVE-2026-120221 frr: bgpd double free of peer-group Site-of-Origin when dynamic neighbors disconnect

In FRRouting, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its...

CVE-2026-120221 frr: bgpd double free of peer-group Site-of-Origin when dynamic neighbors disconnect

In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but...

EUVD-2026-125277

In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but...

CVE-2026-120221

In FRRouting 8.4 and later , the bgpd daemon is vulnerable to a double free vulnerability when dynamic BGP neighbors disconnect. This occurs if a peer-group used by a "bgp listen range" has a Site-of-Origin (SoO) configured. Because dynamic neighbors share the peer-group's SoO value instead of ma...

PT-2026-146822

In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but...

CVE-2026-120033

In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending...

EUVD-2026-124617

In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that...

CVE-2026-120033 frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a phantom Established session or crashing bgpd with Graceful Restart

In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending...

CVE-2026-120033

In FRRouting 10.1 and later , the bgpd daemon fails to correctly close a BGP session when the Send Hold Timer (RFC 9687) expires. This occurs when a neighbor stops accepting data for twice the hold time while still sending KEEPALIVEs. This flaw leaves the session in a phantom Established state or...

CVE-2026-120033 frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a phantom Established session or crashing bgpd with Graceful Restart

In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that...

PT-2026-145997

In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that...

CVE-2026-120033: frrouting: In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires,…

In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that...

CVE-2026-119776

In all prior released versions of FRRouting, the OSPFv3 for IPv6 implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3...

CVE-2026-119776

In all prior released versions of FRRouting, the OSPFv3 for IPv6 implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3...

CVE-2026-119776

A flaw was found in FRRouting. The Open Shortest Path First version 3 OSPFv3 implementation does not validate that incoming network packets originate from and are destined for expected local network addresses. A remote attacker can exploit this flaw by sending specially crafted packets from a...

DEBIAN-CVE-2026-119776

In all prior released versions of FRRouting, the OSPFv3 for IPv6 implementation does not check that OSPFv3 packets have a link-local source address and either a link-local destination or one of the protocol multicast destination groups. This may enable malicious actors to establish OSPFv3...