pybatfish

Got questions, feedback, or feature requests? Join our community onSlack! Pybatfish Pybatfish is a Python client for Batfish. What is Batfish? Batfish is a network validation tool that provides correctness guarantees for security, reliability, and compliance by analyzing the configuration of...

hardcidr

hardCIDR Background A Linux Bash script to discover the netblocks, or ranges, in CIDR notation owned by the target organization during the intelligence gathering phase of a penetration test. This information is maintained by the five Regional Internet Registries RIRs: ARIN North America RIPE...

tabi

Advanced example This example demonstrates how to use the tabi module in order to detect all possible BGP hijacks seen from a BGP collector. Requirements WARNING : Before trying this example make sure you have at least 2GB of free memory on your computer The installation procedure is described in...

CVE-2026-129456

In FRRouting , the bgpd daemon is vulnerable to a use-after-free and double free condition when processing a malformed Tunnel Encapsulation attribute (type 23) . An attacker can send BGP UPDATE messages where the outer TLV length mismatches the actual attribute length. While the mismatch is logge...

CVE-2022-23046

CVE-2022-23046 PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. Installation 1. Build git clone https://github.com/dnr6419/CVE-2022-23046.git cd CVE-2022-23046 &&...

CVE-2022-23046

CVE-2022-23046 The original discovery and manual PoC is from Fluidattacks: PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php. This PoC executes some easy SQLi to fetch info...

PT-2026-147435

Name of the Vulnerable Software and Affected Versions FRRouting affected versions not specified Description In bgpd, the process accepts a Tunnel Encapsulation attribute type 23 where the outer TLV Type-Length-Value length does not match the actual attribute length. This mismatch causes the...

CVE-2026-129217 bgpd: out-of-bounds heap read and crash on NOTIFICATION Cease/Hard Reset with one data byte

In FRRouting FRR 8.3 through 10.5.1, bgpnotifydecapsulatehardreset in bgpd/bgppacket.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message RFC 8538. When the data field is exactly one byte long, the function reads one byte past the end of a heap...

CVE-2026-129217

FRRouting (FRR) versions 8.3 through 10.5.1 are vulnerable to an out-of-bounds heap read and subsequent crash in the bgpd daemon. The flaw exists in the bgp_notify_decapsulate_hard_reset() function within bgpd/bgp_packet.c, which fails to validate the data field length of received BGP NOTIFICATIO...

EUVD-2026-125721

In FRRouting FRR 8.3 through 10.5.1, bgpnotifydecapsulatehardreset in bgpd/bgppacket.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message RFC 8538. When the data field is exactly one byte long, the function reads one byte past the end of a heap...

CVE-2026-120221

In FRRouting, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its...

EUVD-2026-125277

In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but...

CVE-2026-120221 frr: bgpd double free of peer-group Site-of-Origin when dynamic neighbors disconnect

In FRRouting, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its...

CVE-2026-120221

In FRRouting 8.4 and later , the bgpd daemon is vulnerable to a double free vulnerability when dynamic BGP neighbors disconnect. This occurs if a peer-group used by a "bgp listen range" has a Site-of-Origin (SoO) configured. Because dynamic neighbors share the peer-group's SoO value instead of ma...

EUVD-2026-124915

Memory overflow / improper handling in BGP dynamic routing can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway...

CVE-2026-120866

A memory overflow and improper handling within the BGP dynamic routing component of Citrix NetScaler ADC and Citrix NetScaler Gateway can lead to unpredictable behavior or a Denial of Service (DoS) . Technical details regarding specific affected versions or a particular root cause are not provide...

PT-2026-146455

Memory overflow / improper handling in BGP dynamic routing can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway...

PT-2026-146822

In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but...

CVE-2026-120033

In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending...

EUVD-2026-124617

In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that...