CVE-2026-129217 · Infrastructure
NO FIX YET · SEE WHAT TO DO
A malformed BGP Cease/Hard Reset NOTIFICATION with a one-byte data field makes FRRouting's bgpd read past a heap buffer and then hit an assertion failure. A remote BGP peer can crash the daemon and drop all BGP sessions.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any network running FRRouting 8.3 through 10.5.1 with BGP sessions can be affected. The attack needs an established BGP peer that negotiated Graceful Restart with the N bit, so a peer can reach the daemon only over the BGP session. Operators who run BGP only inside a tightly controlled peering setup face less exposure.
Not affected if default-config, no-bgp
Who cares bgp, frrouting, network-routers, self-hosted
vtysh -c 'show version' and compare the FRRouting version with the fixed releases.10.0.510.1.510.2.610.3.410.4.3In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message (RFC 8538). When the data field is exactly one byte long, the function reads one byte past the end of a heap buffer and the 16-bit length of the encapsulated data underflows to 65535, causing a 65535-byte out-of-bounds heap read followed by an assertion failure. A remote BGP peer that has established a session and negotiated the Graceful Restart capability with the Notification (N) bit can send such a message to crash the bgpd daemon, terminating all BGP sessions (denial of service). This is fixed in 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2 and 10.6.0.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
10.5.210.6.0