CVE-2026-129456

In FRRouting’s bgpd, a Tunnel Encapsulation attribute (type 23) can be sent with a malformed outer TLV length that does not match the actual attribute size. The router logs the mismatch but still processes the attribute, decrementing the reference count of the attribute’s internal sub‑TLV chain. When routes that reference that chain are withdrawn or replaced, bgpd accesses freed memory, spurious ref‑count decrements occur, and a second free is attempted. In practice this causes an assertion failure and process abort, dropping all BGP sessions on the router and allowing the malicious peer to repeat the attack on each restart. Thus the vulnerability leads to a denial of service and, because memory is freed and reused, other unintended effects cannot be ruled out.

The protocol daemon bgpd in the FRRouting project, both under its original bundled distribution and under any distribution that includes FRRouting (frrouting:frrouting). All versions of FRRouting that do not contain the patch committing proper TLV length validation are affected; affected versions are those listed before the remedial commit referenced in the advisory.

The CVSS score of 7.7 places this flaw in the high severity class. Exploitation requires that an attacker already owns or can wire an active BGP session to the router, therefore the attack vector is remote but limited to legitimate BGP peers. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but once a peer can send a malformed attribute it can repeatedly crash bgpd after it is restarted. The worst outcome is permanent loss of BGP peering until the router is patched or the rogue attribute is filtered; if the attacker can control multiple peers or compromise the router’s BGP session they may cause widespread routing outages. The misuse of the global memory allocator in this CVE raises the possibility of memory corruption that could compromise the router’s overall process integrity beyond a simple crash.