--- id: "CVE-2026-129456" page: "https://infrastack.ai/live/CVE-2026-129456" kind: "vulnerability" aliases: ["CVE-2026-129456"] title: "FRRouting bgpd: malformed Tunnel Encapsulation attribute can crash BGP daemon" severity: "high" cvss: 7.7 epss: null exploited: false status: "open" category: "runtime" products: [{"name": "frr", "fixed": ["10.2.6", "10.3.4", "10.4.4", "10.5.4"], "affected": "< 10.2.6, 10.3.x < 10.3.4, 10.4.x < 10.4.4, 10.5.x < 10.5.4 (10.6.x: see fix)", "ecosystem": "vendor"}] ecosystems: [] tags: ["bgp", "bgpd", "frrouting", "routers", "runtime", "self-hosted"] not_affected_if: ["no-bgp", "trusted-peers-only"] published_at: "2026-11-14T20:17:40+00:00" first_seen_at: "2026-11-14T20:33:12+00:00" updated_at: "2026-11-14T20:36:23+00:00" sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129456", "first_seen_at": "2026-11-14T20:33:12+00:00"}, {"source": "analyst", "url": "https://github.com/FRRouting/frr/issues/20874", "first_seen_at": "2026-11-14T20:36:23+00:00", "cites": ["https://github.com/FRRouting/frr/issues/20874", "https://github.com/FRRouting/frr/pull/21176", "https://frrouting.org/release/10.5.4/", "https://frrouting.org/release/10.4.4/", "https://frrouting.org/release/10.3.4/", "https://frrouting.org/release/10.2.6/"]}] exploit_sources: [] --- # FRRouting bgpd: malformed Tunnel Encapsulation attribute can crash BGP daemon Link for people: https://infrastack.ai/live/CVE-2026-129456 (this .md is for agents) FRRouting's bgpd accepts a BGP Tunnel Encapsulation attribute whose length fields do not match, which leads to a double free of memory after routes are replaced or the session drops. A BGP neighbor with an established session can crash bgpd, dropping all BGP sessions on the router, and possibly corrupt memory further. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:frr affected < 10.2.6, 10.3.x < 10.3.4, 10.4.x < 10.4.4, 10.5.x < 10.5.4 (10.6.x: see fix) fixed 10.2.6, 10.3.4, 10.4.4, 10.5.4 ## How to check - Run vtysh -c 'show version' (or bgpd --version): on the 10.2-10.5 branches, anything below 10.2.6 / 10.3.4 / 10.4.4 / 10.5.4 is unfixed; for 10.6.x confirm the build includes the fix commit (bbeaa5b, backport of #21176). - Distro packages (Debian/RPM/Docker quay.io/frrouting/frr): check the package changelog for 'Prevent heap use-after-free for tunnel encapsulation attribute' or #21176. - Exposure needs an established BGP session; the reporter reproduced it with 'soft-reconfiguration inbound' on the neighbor (grep frr.conf or vtysh -c 'show running-config'), but the sources do not say it is required. - Lowest affected version is unknown. ## Fix Upgrade FRRouting to a release carrying PR #21176 (bgpd now treats a Tunnel Encapsulation attribute with mismatched TLV length as malformed and withdraws the route): 10.5.4, 10.4.4, 10.3.4 or 10.2.6 (all released 2026-04-23, release notes list it), or current master. The stable/10.6 backport (#21177) was merged 2026-03-15, but the 10.6.1 notes do not list it; check that your 10.6.x build includes commit bbeaa5b. No workaround is stated by the vendor; RFC 9012 says attribute 23 should be filtered on eBGP sessions, but FRR's own text on a discard setting was not found. ## Timeline - 2026-11-14T20:33:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129456 - 2026-11-14T20:36:23+00:00 analyst https://github.com/FRRouting/frr/issues/20874 — Primary: FRR issue 20874, PR 21176, release notes 10.2.6/10.3.4/10.4.4/10.5.4 list the fix. Not exploited, no public weaponised PoC (ASAN traces in issue). 10.6.x fix release unconfirmed; lower affected bound unknown. ## Documents - [describes] bgpd: heap-use-after-free in encap_unintern() (FRR issue 20874) https://github.com/FRRouting/frr/issues/20874 - [fix] Patch: github.com https://github.com/FRRouting/frr/commit/bebf95f02bc0dccc6a1841f0c8cbcba1f617d655 - [fix] Patch: github.com https://github.com/FRRouting/frr/commit/abef07b500e19baa924d157ab03809b93730e619 - [fix] bgpd: Prevent heap use-after-free for tunnel encapsulation attribute (PR 21176) https://github.com/FRRouting/frr/pull/21176 - [fix] FRRouting Release 10.5.4 https://frrouting.org/release/10.5.4/ - [fix] FRRouting Release 10.4.4 https://frrouting.org/release/10.4.4/ - [fix] FRRouting Release 10.3.4 https://frrouting.org/release/10.3.4/ - [fix] FRRouting Release 10.2.6 https://frrouting.org/release/10.2.6/ ## From the sources In FRRouting, bgpd accepts a Tunnel Encapsulation attribute (type 23) whose outer TLV length does not match the length of the attribute: the mismatch is only logged and the attribute is processed anyway. A BGP neighbor can send UPDATE messages carrying such an attribute that put the reference count of the attribute's interned sub-TLV chain out of balance, so that the chain is freed while routes stored by bgpd (Adj-RIB-In entries and RIB paths) still point to it. When those routes are later replaced, withdrawn or cleared, for example when the session goes down, bgpd reads the freed memory, decrements a reference count inside it and frees it a second time. In the reporter's build without AddressSanitizer this ended in an assertion failure in bgpd's memory accounting, aborting bgpd and dropping all BGP sessions on the router, and the neighbor can repeat it each time bgpd restarts. Because freed heap memory is written to and freed again, consequences beyond a crash cannot be ruled out. An established BGP session is required. bgpd processes attribute 23 from every neighbor, including eBGP neighbors, unless it is explicitly discarded, although RFC 9012 requires it to be filtered on eBGP sessions by default. The issue was reproduced with "soft-reconfiguration inbound" configured for the neighbor, and the reporter observed that the crash does not occur on every attempt. --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_