Out-of-Bounds Read Vulnerability in FRRouting Affecting Network Stability
CVE-2026-129217

6MEDIUM

Key Information:

Vendor

Frrouting

Status
Frrouting
Vendor
CVE Published:
13 November 2026

What is CVE-2026-129217?

In FRRouting versions from 8.3 to 10.5.1, the function bgp_notify_decapsulate_hard_reset() fails to validate the length of the data field in a received BGP NOTIFICATION Cease/Hard Reset message, leading to an out-of-bounds read of a heap buffer. This issue allows a remote BGP peer to send a crafted message that triggers an assertion failure, effectively causing the bgpd daemon to crash and resulting in a denial of service for all concurrent BGP sessions. This vulnerability is addressed in versions 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2, and 10.6.0.

Affected Version(s)

FRRouting 10.5.0 < 10.5.2

FRRouting 10.4.0 < 10.4.3

FRRouting 10.3 < 10.3.4

References

https://github.com/FRRouting/frr/issues/20793
issue-tracking
https://github.com/FRRouting/frr/pull/20796
patch

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Fault Chain (https://faultchain.com/)
.