CVE-2026-129217: bgpd: out-of-bounds heap read and crash on NOTIFICATION Cease/Hard Reset with one data byte
In FRRouting (FRR) 8.3 through 10.5.1, bgpnotifydecapsulatehardreset() in bgpd/bgppacket.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message (RFC 8538). When the data field is exactly one byte long, the function reads one byte past the end of a heap buffer and the 16-bit length of the encapsulated data underflows to 65535, causing a 65535-byte out-of-bounds heap read followed by an assertion failure. A remote BGP peer that has established a session and negotiated the Graceful Restart capability with the Notification (N) bit can send such a message to crash the bgpd daemon, terminating all BGP sessions (denial of service). This is fixed in 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2 and 10.6.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.6.0
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
FRR deployments running bgpd versions 8.3 through 10.5.1 are affected if a remote BGP peer can establish a session and Graceful Restart is negotiated with the Notification (N) bit. An unauthenticated Internet host that cannot establish such a BGP session is not described as able to trigger the issue.
What does an attacker need to send to trigger the crash?
The peer must send a BGP NOTIFICATION message with Cease/Hard Reset semantics whose data field is exactly one byte long. This causes an underflowed encapsulated-data length and an out-of-bounds heap read, followed by an assertion failure in bgpd.
What is the operational impact if exploitation succeeds?
The bgpd daemon crashes, terminating all BGP sessions. The described impact is denial of service rather than route manipulation or disclosure.
Which releases contain fixes?
Fixed releases are 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2, and 10.6.0.