{"id":"CVE-2026-129456","kind":"vulnerability","aliases":["CVE-2026-129456"],"related":[],"title":"FRRouting bgpd: malformed Tunnel Encapsulation attribute can crash BGP daemon","description":"In FRRouting, bgpd accepts a Tunnel Encapsulation attribute (type 23) whose outer TLV length does not match the length of the attribute: the mismatch is only logged and the attribute is processed anyway. A BGP neighbor can send UPDATE messages carrying such an attribute that put the reference count of the attribute's interned sub-TLV chain out of balance, so that the chain is freed while routes stored by bgpd (Adj-RIB-In entries and RIB paths) still point to it. When those routes are later replaced, withdrawn or cleared, for example when the session goes down, bgpd reads the freed memory, decrements a reference count inside it and frees it a second time. In the reporter's build without AddressSanitizer this ended in an assertion failure in bgpd's memory accounting, aborting bgpd and dropping all BGP sessions on the router, and the neighbor can repeat it each time bgpd restarts. Because freed heap memory is written to and freed again, consequences beyond a crash cannot be ruled out. An established BGP session is required. bgpd processes attribute 23 from every neighbor, including eBGP neighbors, unless it is explicitly discarded, although RFC 9012 requires it to be filtered on eBGP sessions by default. The issue was reproduced with \"soft-reconfiguration inbound\" configured for the neighbor, and the reporter observed that the crash does not occur on every attempt.","summary":"FRRouting's bgpd accepts a BGP Tunnel Encapsulation attribute whose length fields do not match, which leads to a double free of memory after routes are replaced or the session drops. A BGP neighbor with an established session can crash bgpd, dropping all BGP sessions on the router, and possibly corrupt memory further.","severity":"high","cvss":7.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"frr","fixed":["10.2.6","10.3.4","10.4.4","10.5.4"],"affected":"< 10.2.6, 10.3.x < 10.3.4, 10.4.x < 10.4.4, 10.5.x < 10.5.4 (10.6.x: see fix)","ecosystem":"vendor"}],"ecosystems":[],"tags":["bgp","bgpd","frrouting","routers","runtime","self-hosted"],"not_affected_if":["no-bgp","trusted-peers-only"],"how_to_check":"- Run vtysh -c 'show version' (or bgpd --version): on the 10.2-10.5 branches, anything below 10.2.6 / 10.3.4 / 10.4.4 / 10.5.4 is unfixed; for 10.6.x confirm the build includes the fix commit (bbeaa5b, backport of #21176).\n- Distro packages (Debian/RPM/Docker quay.io/frrouting/frr): check the package changelog for 'Prevent heap use-after-free for tunnel encapsulation attribute' or #21176.\n- Exposure needs an established BGP session; the reporter reproduced it with 'soft-reconfiguration inbound' on the neighbor (grep frr.conf or vtysh -c 'show running-config'), but the sources do not say it is required.\n- Lowest affected version is unknown.","fix":"Upgrade FRRouting to a release carrying PR #21176 (bgpd now treats a Tunnel Encapsulation attribute with mismatched TLV length as malformed and withdraws the route): 10.5.4, 10.4.4, 10.3.4 or 10.2.6 (all released 2026-04-23, release notes list it), or current master. The stable/10.6 backport (#21177) was merged 2026-03-15, but the 10.6.1 notes do not list it; check that your 10.6.x build includes commit bbeaa5b. No workaround is stated by the vendor; RFC 9012 says attribute 23 should be filtered on eBGP sessions, but FRR's own text on a discard setting was not found.","status":"open","published_at":"2026-11-14T20:17:40+00:00","first_seen_at":"2026-11-14T20:33:12+00:00","triaged_at":"2026-11-14T20:35:12+00:00","updated_at":"2026-11-14T20:36:23+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-14T20:35:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FRRouting bgpd: malformed Tunnel Encapsulation attribute can crash BGP daemon","impact":"high","summary":"FRRouting's bgpd accepts a BGP Tunnel Encapsulation attribute whose length fields do not match, which leads to a double free of memory after routes are replaced or the session drops. A BGP neighbor with an established session can crash bgpd, dropping all BGP sessions on the router, and possibly corrupt memory further.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["frrouting","bgpd","bgp","routers","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"bgpd crashes, dropping all BGP sessions; possible memory corruption","analyst_note":"Fixed FRRouting versions and workarounds are not stated in the signal; check the linked github.com patch commits and the FRR security advisory for affected ranges.","how_to_check":"- Check the FRRouting version with `vtysh -c 'show version'` or `bgpd --version`, and compare it with the fixed versions in the advisory.\n- Look for BGP neighbors configured with `soft-reconfiguration inbound` in `frr.conf` or `vtysh -c 'show running-config'`.\n- Check whether eBGP neighbors discard attribute 23 (unknown whether the sources list a specific setting).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-bgp","trusted-peers-only"],"who_is_affected":"Routers running FRRouting bgpd with established BGP sessions are exposed, since any BGP neighbor can send the malformed attribute. The sources say bgpd processes attribute 23 from eBGP neighbors unless it is explicitly discarded, and the crash was reproduced with soft-reconfiguration inbound configured. Networks that do not run FRRouting bgpd, or that accept BGP only from fully trusted peers, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000866,"input_tokens":4957,"output_tokens":740,"severity_before":"high"},"analyst_status":"done","analyst_note":"Fixed FRRouting versions and workarounds are not stated in the signal; check the linked github.com patch commits and the FRR security advisory for affected ranges.","search":"'-129456':13A,16A '-2026':12A,15A '23':87C,260C '9012':274C 'abort':213C 'accept':29B,81C 'account':212C 'addresssanit':201C 'adj':151C 'adj-rib-in':150C 'although':272C 'anyway':110C 'assert':206C 'attempt':310C 'attribut':6A,34B,85C,99C,107C,121C,129C,259C 'balanc':138C 'beyond':244C 'bgp':9A,18B,31B,58B,69B,112C,218C,253C 'bgpd':2A,19B,28B,66B,80C,149C,178C,209C,214C,231C,257C 'build':199C 'cannot':247C 'carri':118C 'chain':135C,142C 'clear':170C 'configur':294C 'consequ':243C 'corrupt':76B 'count':126C,186C 'crash':8A,65B,246C,304C 'cve':11A,14A 'daemon':10A 'decrement':183C 'default':284C 'discard':271C 'doubl':45B 'drop':56B,67B,216C 'ebgp':265C,281C 'encapsul':5A,33B,84C 'end':203C 'entri':154C 'establish':62B,252C 'everi':262C,309C 'exampl':172C 'explicit':270C 'failur':207C 'field':37B 'filter':279C 'free':46B,190C 'freed':144C,181C,234C,241C 'frr':17A 'frrout':1A,20B,26B,79C 'goe':176C 'heap':235C 'host':25B 'inbound':293C 'includ':264C 'insid':187C 'intern':131C 'issu':286C 'later':166C 'lead':42B 'length':36B,91C,96C 'log':104C 'malform':3A 'match':40B,94C 'memori':48B,77B,182C,211C,236C 'messag':117C 'mismatch':101C 'neighbor':59B,113C,225C,263C,266C,297C 'observ':301C 'occur':307C 'outer':89C 'path':157C 'point':159C 'possibl':75B 'process':109C,258C 'put':123C 'read':179C 'reconfigur':292C 'refer':125C,185C 'repeat':227C 'replac':52B,167C 'report':197C,300C 'reproduc':288C 'requir':256C,275C 'restart':232C 'rfc':273C 'rib':152C,156C 'rout':50B,146C,164C 'router':21B,73B,222C 'rule':249C 'runtim':22B 'second':193C 'self':24B 'self-host':23B 'send':115C 'session':55B,63B,70B,175C,219C,254C,282C 'soft':291C 'soft-reconfigur':290C 'still':158C 'store':147C 'sub':133C 'sub-tlv':132C 'time':194C,230C 'tlv':90C,134C 'tunnel':4A,32B,83C 'type':86C 'unless':267C 'updat':116C 'whose':35B,88C 'withdrawn':168C 'without':200C 'written':238C","nicknames":[],"mitigations":[],"who_affected":"Routers running FRRouting bgpd with established BGP sessions are exposed, since any BGP neighbor can send the malformed attribute. The sources say bgpd processes attribute 23 from eBGP neighbors unless it is explicitly discarded, and the crash was reproduced with soft-reconfiguration inbound configured. Networks that do not run FRRouting bgpd, or that accept BGP only from fully trusted peers, are less exposed.","tier":"B","verified":{"fix":{"at":"2026-11-14T20:36:23Z","by":"analyst","doc":"https://github.com/FRRouting/frr/commit/abef07b500e19baa924d157ab03809b93730e619","run_id":4001}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["frr"],"ptokens":["frr"],"labels":["bgp","bgpd","frrouting","high","routers","runtime","selfhosted"],"campaign_type":null,"search_a":"'-129456':13A,16A '-2026':12A,15A 'attribut':6A 'bgp':9A 'bgpd':2A 'crash':8A 'cve':11A,14A 'daemon':10A 'encapsul':5A 'frr':17A 'frrout':1A 'malform':3A 'tunnel':4A","search_b":"'accept':29B 'attribut':34B 'bgp':18B,31B,58B,69B 'bgpd':19B,28B,66B 'corrupt':76B 'crash':65B 'doubl':45B 'drop':56B,67B 'encapsul':33B 'establish':62B 'field':37B 'free':46B 'frrout':20B,26B 'host':25B 'lead':42B 'length':36B 'match':40B 'memori':48B,77B 'neighbor':59B 'possibl':75B 'replac':52B 'rout':50B 'router':21B,73B 'runtim':22B 'self':24B 'self-host':23B 'session':55B,63B,70B 'tunnel':32B 'whose':35B","search_c":"'23':87C,260C '9012':274C 'abort':213C 'accept':81C 'account':212C 'addresssanit':201C 'adj':151C 'adj-rib-in':150C 'although':272C 'anyway':110C 'assert':206C 'attempt':310C 'attribut':85C,99C,107C,121C,129C,259C 'balanc':138C 'beyond':244C 'bgp':112C,218C,253C 'bgpd':80C,149C,178C,209C,214C,231C,257C 'build':199C 'cannot':247C 'carri':118C 'chain':135C,142C 'clear':170C 'configur':294C 'consequ':243C 'count':126C,186C 'crash':246C,304C 'decrement':183C 'default':284C 'discard':271C 'drop':216C 'ebgp':265C,281C 'encapsul':84C 'end':203C 'entri':154C 'establish':252C 'everi':262C,309C 'exampl':172C 'explicit':270C 'failur':207C 'filter':279C 'free':190C 'freed':144C,181C,234C,241C 'frrout':79C 'goe':176C 'heap':235C 'inbound':293C 'includ':264C 'insid':187C 'intern':131C 'issu':286C 'later':166C 'length':91C,96C 'log':104C 'match':94C 'memori':182C,211C,236C 'messag':117C 'mismatch':101C 'neighbor':113C,225C,263C,266C,297C 'observ':301C 'occur':307C 'outer':89C 'path':157C 'point':159C 'process':109C,258C 'put':123C 'read':179C 'reconfigur':292C 'refer':125C,185C 'repeat':227C 'replac':167C 'report':197C,300C 'reproduc':288C 'requir':256C,275C 'restart':232C 'rfc':273C 'rib':152C,156C 'rout':146C,164C 'router':222C 'rule':249C 'second':193C 'send':115C 'session':175C,219C,254C,282C 'soft':291C 'soft-reconfigur':290C 'still':158C 'store':147C 'sub':133C 'sub-tlv':132C 'time':194C,230C 'tlv':90C,134C 'tunnel':83C 'type':86C 'unless':267C 'updat':116C 'whose':88C 'withdrawn':168C 'without':200C 'written':238C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T20:17:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X","cvss_by":"57a55968-44ac-464c-a794-6ba3baad09c4","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129456","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129456","severity":null,"published_at":"2026-11-14T20:17:40+00:00","modified_at":"2026-11-14T20:17:40+00:00","first_seen_at":"2026-11-14T20:33:12+00:00","fetched_at":"2026-11-14T20:33:12+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-129456:4001","url":"https://github.com/FRRouting/frr/issues/20874","severity":null,"published_at":"2026-11-14T20:36:23+00:00","modified_at":"2026-11-14T20:36:23+00:00","first_seen_at":"2026-11-14T20:36:23+00:00","fetched_at":"2026-11-14T20:36:23+00:00","note":"Primary: FRR issue 20874, PR 21176, release notes 10.2.6/10.3.4/10.4.4/10.5.4 list the fix. Not exploited, no public weaponised PoC (ASAN traces in issue). 10.6.x fix release unconfirmed; lower affected bound unknown.","cites":["https://github.com/FRRouting/frr/issues/20874","https://github.com/FRRouting/frr/pull/21176","https://frrouting.org/release/10.5.4/","https://frrouting.org/release/10.4.4/","https://frrouting.org/release/10.3.4/","https://frrouting.org/release/10.2.6/"]}],"documents":[{"id":158246,"url":"https://github.com/FRRouting/frr/commit/abef07b500e19baa924d157ab03809b93730e619","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":158247,"url":"https://github.com/FRRouting/frr/commit/bebf95f02bc0dccc6a1841f0c8cbcba1f617d655","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":158254,"url":"https://github.com/FRRouting/frr/issues/20874","title":"bgpd: heap-use-after-free in encap_unintern() (FRR issue 20874)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":158255,"url":"https://github.com/FRRouting/frr/pull/21176","title":"bgpd: Prevent heap use-after-free for tunnel encapsulation attribute (PR 21176)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":158256,"url":"https://frrouting.org/release/10.5.4/","title":"FRRouting Release 10.5.4","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":158257,"url":"https://frrouting.org/release/10.4.4/","title":"FRRouting Release 10.4.4","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":158258,"url":"https://frrouting.org/release/10.3.4/","title":"FRRouting Release 10.3.4","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":158259,"url":"https://frrouting.org/release/10.2.6/","title":"FRRouting Release 10.2.6","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}