BGP Memory Management Vulnerability in FRRouting

CVE-2026-129456

What is CVE-2026-129456?

In FRRouting's bgpd, a flaw exists related to the handling of Tunnel Encapsulation attributes where the outer TLV length may not align with the defined attribute length. This misalignment allows a malicious BGP neighbor to send malformed UPDATE messages that disrupt the reference counting of the related sub-TLV chain. Consequently, this can lead to memory being improperly managed, potentially resulting in crashes and unexpected behavior in BGP sessions. The issue may be exploited repeatedly until the bgpd service is restarted, raising concerns over the stability and security of BGP implementations. Adherence to RFC 9012 filtering guidelines is critical to prevent unauthorized attribute processing, particularly with eBGP sessions.

References