---
id: "CVE-2026-129217"
page: "https://infrastack.ai/live/CVE-2026-129217"
kind: "vulnerability"
aliases: ["CVE-2026-129217"]
title: "FRRouting BGP daemon crashes on malformed Cease Hard Reset notification"
severity: "medium"
cvss: 6.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["bgp", "frrouting", "infrastructure", "network-routers", "self-hosted"]
not_affected_if: ["default-config", "no-bgp"]
published_at: "2026-11-13T19:19:32+00:00"
first_seen_at: "2026-11-13T19:52:09+00:00"
updated_at: "2026-11-13T19:54:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129217", "first_seen_at": "2026-11-13T19:52:09+00:00"}]
exploit_sources: []
---

# FRRouting BGP daemon crashes on malformed Cease Hard Reset notification

Link for people: https://infrastack.ai/live/CVE-2026-129217 (this .md is for agents)

A malformed BGP Cease/Hard Reset NOTIFICATION with a one-byte data field makes FRRouting's bgpd read past a heap buffer and then hit an assertion failure. A remote BGP peer can crash the daemon and drop all BGP sessions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `vtysh -c 'show version'` and compare the FRRouting version with the fixed releases.
- Check whether BGP peers are configured with Graceful Restart and the Notification (N) bit enabled.

## Fix

- FRRouting 10.0.x: `10.0.5`
- FRRouting 10.1.x: `10.1.5`
- FRRouting 10.2.x: `10.2.6`
- FRRouting 10.3.x: `10.3.4`
- FRRouting 10.4.x: `10.4.3`
- FRRouting 10.5.x: `10.5.2`
- FRRouting 10.6: `10.6.0`

## Timeline

- 2026-11-13T19:52:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129217

## From the sources

In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message (RFC 8538). When the data field is exactly one byte long, the function reads one byte past the end of a heap buffer and the 16-bit length of the encapsulated data underflows to 65535, causing a 65535-byte out-of-bounds heap read followed by an assertion failure. A remote BGP peer that has established a session and negotiated the Graceful Restart capability with the Notification (N) bit can send such a message to crash the bgpd daemon, terminating all BGP sessions (denial of service). This is fixed in 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2 and 10.6.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_