CVE-2026-129456

In FRRouting, bgpd frees the sub-TLV chain of a Tunnel Encapsulation attribute type 23 while routes stored by bgpd still point to it, if the attribute is received from a neighbor that has "soft-reconfiguration inbound" configured. A cache added to speed up attribute interning while processing the...

CVE-2026-129456 frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs via the attribute intern reuse cache with soft-reconfiguration inbound

In FRRouting, bgpd frees the sub-TLV chain of a Tunnel Encapsulation attribute type 23 while routes stored by bgpd still point to it, if the attribute is received from a neighbor that has "soft-reconfiguration inbound" configured. A cache added to speed up attribute interning while processing the...

EUVD-2026-125947

In FRRouting, bgpd accepts a Tunnel Encapsulation attribute type 23 whose outer TLV length does not match the length of the attribute: the mismatch is only logged and the attribute is processed anyway. A BGP neighbor can send UPDATE messages carrying such an attribute that put the reference count...

CVE-2026-129456 frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs after a malformed attribute length from a peer

In FRRouting, bgpd accepts a Tunnel Encapsulation attribute type 23 whose outer TLV length does not match the length of the attribute: the mismatch is only logged and the attribute is processed anyway. A BGP neighbor can send UPDATE messages carrying such an attribute that put the reference count...

CVE-2026-129456

In FRRouting , the bgpd daemon is vulnerable to a use-after-free and double free condition when processing a malformed Tunnel Encapsulation attribute (type 23) . An attacker can send BGP UPDATE messages where the outer TLV length mismatches the actual attribute length. While the mismatch is logge...

PT-2026-147435

Name of the Vulnerable Software and Affected Versions FRRouting affected versions not specified Description In bgpd, the process accepts a Tunnel Encapsulation attribute type 23 where the outer TLV Type-Length-Value length does not match the actual attribute length. This mismatch causes the...

CVE-2026-129217 bgpd: out-of-bounds heap read and crash on NOTIFICATION Cease/Hard Reset with one data byte

In FRRouting FRR 8.3 through 10.5.1, bgpnotifydecapsulatehardreset in bgpd/bgppacket.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message RFC 8538. When the data field is exactly one byte long, the function reads one byte past the end of a heap...

CVE-2026-129217

FRRouting (FRR) versions 8.3 through 10.5.1 are vulnerable to an out-of-bounds heap read and subsequent crash in the bgpd daemon. The flaw exists in the bgp_notify_decapsulate_hard_reset() function within bgpd/bgp_packet.c, which fails to validate the data field length of received BGP NOTIFICATIO...

EUVD-2026-125721

In FRRouting FRR 8.3 through 10.5.1, bgpnotifydecapsulatehardreset in bgpd/bgppacket.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message RFC 8538. When the data field is exactly one byte long, the function reads one byte past the end of a heap...

CVE-2026-120221

In FRRouting, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its...

CVE-2026-120221 frr: bgpd double free of peer-group Site-of-Origin when dynamic neighbors disconnect

In FRRouting, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its...

EUVD-2026-125277

In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but...

CVE-2026-120221 frr: bgpd double free of peer-group Site-of-Origin when dynamic neighbors disconnect

In FRRouting, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but frees it as its...

CVE-2026-120221

In FRRouting 8.4 and later , the bgpd daemon is vulnerable to a double free vulnerability when dynamic BGP neighbors disconnect. This occurs if a peer-group used by a "bgp listen range" has a Site-of-Origin (SoO) configured. Because dynamic neighbors share the peer-group's SoO value instead of ma...

PT-2026-146822

In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured "neighbor PG soo". Each dynamic neighbor shares the peer-group's SoO value instead of getting its own copy, but...

CVE-2026-120033

In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending...

CVE-2026-120033

In FRRouting 10.1 and later , the bgpd daemon fails to correctly close a BGP session when the Send Hold Timer (RFC 9687) expires. This occurs when a neighbor stops accepting data for twice the hold time while still sending KEEPALIVEs. This flaw leaves the session in a phantom Established state or...

CVE-2026-120033 frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a phantom Established session or crashing bgpd with Graceful Restart

In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending...

EUVD-2026-124617

In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that...

CVE-2026-120033 frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a phantom Established session or crashing bgpd with Graceful Restart

In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer RFC 9687 expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending...