{"id":"CVE-2026-129217","kind":"vulnerability","aliases":["CVE-2026-129217"],"related":[],"title":"FRRouting BGP daemon crashes on malformed Cease Hard Reset notification","description":"In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message (RFC 8538). When the data field is exactly one byte long, the function reads one byte past the end of a heap buffer and the 16-bit length of the encapsulated data underflows to 65535, causing a 65535-byte out-of-bounds heap read followed by an assertion failure. A remote BGP peer that has established a session and negotiated the Graceful Restart capability with the Notification (N) bit can send such a message to crash the bgpd daemon, terminating all BGP sessions (denial of service). This is fixed in 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2 and 10.6.0.","summary":"A malformed BGP Cease/Hard Reset NOTIFICATION with a one-byte data field makes FRRouting's bgpd read past a heap buffer and then hit an assertion failure. A remote BGP peer can crash the daemon and drop all BGP sessions.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bgp","frrouting","infrastructure","network-routers","self-hosted"],"not_affected_if":["default-config","no-bgp"],"how_to_check":"- Run `vtysh -c 'show version'` and compare the FRRouting version with the fixed releases.\n- Check whether BGP peers are configured with Graceful Restart and the Notification (N) bit enabled.","fix":"- FRRouting 10.0.x: `10.0.5`\n- FRRouting 10.1.x: `10.1.5`\n- FRRouting 10.2.x: `10.2.6`\n- FRRouting 10.3.x: `10.3.4`\n- FRRouting 10.4.x: `10.4.3`\n- FRRouting 10.5.x: `10.5.2`\n- FRRouting 10.6: `10.6.0`","status":"open","published_at":"2026-11-13T19:19:32+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","triaged_at":"2026-11-13T19:54:13+00:00","updated_at":"2026-11-13T19:54:13+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-13T19:54:13Z","model":"claude-haiku-5-5","output":{"fix":"- FRRouting 10.0.x: `10.0.5`\n- FRRouting 10.1.x: `10.1.5`\n- FRRouting 10.2.x: `10.2.6`\n- FRRouting 10.3.x: `10.3.4`\n- FRRouting 10.4.x: `10.4.3`\n- FRRouting 10.5.x: `10.5.2`\n- FRRouting 10.6: `10.6.0`","reach":"network","title":"FRRouting BGP daemon crashes on malformed Cease Hard Reset notification","impact":"medium","summary":"A malformed BGP Cease/Hard Reset NOTIFICATION with a one-byte data field makes FRRouting's bgpd read past a heap buffer and then hit an assertion failure. A remote BGP peer can crash the daemon and drop all BGP sessions.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["frrouting","bgp","network-routers","self-hosted"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Remote BGP peer crashes bgpd, terminating all BGP sessions","analyst_note":"","how_to_check":"- Run `vtysh -c 'show version'` and compare the FRRouting version with the fixed releases.\n- Check whether BGP peers are configured with Graceful Restart and the Notification (N) bit enabled.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-bgp","default-config"],"who_is_affected":"Any network running FRRouting 8.3 through 10.5.1 with BGP sessions can be affected. The attack needs an established BGP peer that negotiated Graceful Restart with the N bit, so a peer can reach the daemon only over the BGP session. Operators who run BGP only inside a tightly controlled peering setup face less exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000824,"input_tokens":4788,"output_tokens":690,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129217':13A,16A '-2026':12A,15A '10.0.5':188C '10.1.5':189C '10.2.6':190C '10.3.4':191C '10.4.3':192C '10.5.1':72C '10.5.2':193C '10.6.0':195C '16':122C '65535':131C,134C '8.3':70C '8538':98C 'assert':52B,145C 'bgp':2A,17B,28B,56B,65B,73C,92C,149C,179C 'bgpd':42B,175C 'bgpd/bgp_packet.c':79C 'bit':123C,166C 'bound':139C 'buffer':47B,119C 'byte':36B,106C,112C,135C 'capabl':161C 'caus':132C 'ceas':7A 'cease/hard':29B,94C 'crash':4A,59B,173C 'cve':11A,14A 'daemon':3A,61B,176C 'data':37B,87C,101C,128C 'decapsul':75C 'denial':181C 'drop':63B 'encapsul':127C 'end':115C 'establish':153C 'exact':104C 'failur':53B,146C 'field':38B,88C,102C 'fix':186C 'follow':142C 'frr':69C 'frrout':1A,18B,40B,68C 'function':109C 'grace':159C 'hard':8A,76C 'heap':46B,118C,140C 'hit':50B 'host':25B 'infrastructur':19B 'length':84C,124C 'long':107C 'make':39B 'malform':6A,27B 'messag':96C,171C 'n':165C 'negoti':157C 'network':21B 'network-rout':20B 'notif':10A,31B,93C,164C 'notifi':74C 'one':35B,105C,111C 'one-byt':34B 'out-of-bound':136C 'past':44B,113C 'peer':57B,150C 'read':43B,110C,141C 'receiv':91C 'remot':55B,148C 'reset':9A,30B,77C,95C 'restart':160C 'rfc':97C 'router':22B 'self':24B 'self-host':23B 'send':168C 'servic':183C 'session':66B,155C,180C 'termin':177C 'underflow':129C 'valid':82C","nicknames":[],"mitigations":[],"who_affected":"Any network running FRRouting 8.3 through 10.5.1 with BGP sessions can be affected. The attack needs an established BGP peer that negotiated Graceful Restart with the N bit, so a peer can reach the daemon only over the BGP session. Operators who run BGP only inside a tightly controlled peering setup face less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["bgp","frrouting","infrastructure","medium","networkrouters","selfhosted"],"campaign_type":null,"search_a":"'-129217':13A,16A '-2026':12A,15A 'bgp':2A 'ceas':7A 'crash':4A 'cve':11A,14A 'daemon':3A 'frrout':1A 'hard':8A 'malform':6A 'notif':10A 'reset':9A","search_b":"'assert':52B 'bgp':17B,28B,56B,65B 'bgpd':42B 'buffer':47B 'byte':36B 'cease/hard':29B 'crash':59B 'daemon':61B 'data':37B 'drop':63B 'failur':53B 'field':38B 'frrout':18B,40B 'heap':46B 'hit':50B 'host':25B 'infrastructur':19B 'make':39B 'malform':27B 'network':21B 'network-rout':20B 'notif':31B 'one':35B 'one-byt':34B 'past':44B 'peer':57B 'read':43B 'remot':55B 'reset':30B 'router':22B 'self':24B 'self-host':23B 'session':66B","search_c":"'10.0.5':188C '10.1.5':189C '10.2.6':190C '10.3.4':191C '10.4.3':192C '10.5.1':72C '10.5.2':193C '10.6.0':195C '16':122C '65535':131C,134C '8.3':70C '8538':98C 'assert':145C 'bgp':73C,92C,149C,179C 'bgpd':175C 'bgpd/bgp_packet.c':79C 'bit':123C,166C 'bound':139C 'buffer':119C 'byte':106C,112C,135C 'capabl':161C 'caus':132C 'cease/hard':94C 'crash':173C 'daemon':176C 'data':87C,101C,128C 'decapsul':75C 'denial':181C 'encapsul':127C 'end':115C 'establish':153C 'exact':104C 'failur':146C 'field':88C,102C 'fix':186C 'follow':142C 'frr':69C 'frrout':68C 'function':109C 'grace':159C 'hard':76C 'heap':118C,140C 'length':84C,124C 'long':107C 'messag':96C,171C 'n':165C 'negoti':157C 'notif':93C,164C 'notifi':74C 'one':105C,111C 'out-of-bound':136C 'past':113C 'peer':150C 'read':110C,141C 'receiv':91C 'remot':148C 'reset':77C,95C 'restart':160C 'rfc':97C 'send':168C 'servic':183C 'session':155C,180C 'termin':177C 'underflow':129C 'valid':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T19:19:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"57a55968-44ac-464c-a794-6ba3baad09c4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129217","severity":null,"published_at":"2026-11-13T19:19:32+00:00","modified_at":"2026-11-13T19:19:32+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","fetched_at":"2026-11-13T19:52:09+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}