BGP Session Management Flaw in FRRouting Router Software

CVE-2026-120033

What is CVE-2026-120033?

In FRRouting versions 10.1 and later, the BGP daemon (bgpd) exhibits a flaw in managing BGP sessions. Specifically, when the Send Hold Timer (defined in RFC 9687) expires, the daemon fails to correctly terminate the BGP session. This could lead to two significant issues: if the remote neighbor announces Graceful Restart support, bgpd may crash after the session is closed, potentially disrupting all BGP sessions on the router. Alternatively, if Graceful Restart is not supported, the session remains in an Established state, causing incorrect route propagation and requiring manual intervention from the operator to clear the BGP session. This behavior can be triggered by any BGP neighbor under default configuration, highlighting the need for caution in managing BGP connections.

References