frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a phantom Established session or crashing bgpd with Graceful Restart
Summary
| CVE | CVE-2026-120033 |
|---|---|
| State | PUBLISHED |
| Assigner | NetDEF |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-12 19:16:48 UTC |
| Updated | 2026-11-14 15:16:57 UTC |
| Description | In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending KEEPALIVEs but stops reading from its connection, at a time when the router has a large amount of data to send to it (for example while sending it a full routing table), can trigger this. If the neighbor announced Graceful Restart support, bgpd crashes shortly after the session is closed, taking down all BGP sessions on the router, and the neighbor can repeat this each time bgpd restarts. Otherwise, the session stays stuck in the Established state: the neighbor's routes stay installed and keep being advertised to other peers, and the neighbor cannot reconnect until an operator clears the session manually. The neighbor does not need to be malicious; an overloaded or stuck peer can trigger the same behavior. No special configuration is required: any established BGP neighbor can trigger the issue, and Graceful Restart helper mode, which leads to the crash, is enabled by default. |
Risk And Classification
Primary CVSS: v4.0 6 MEDIUM from 57a55968-44ac-464c-a794-6ba3baad09c4
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X
EPSS: 0.002940000 probability, percentile 0.222330000 (date 2026-11-13)
Problem Types: CWE-372 | CWE-617 | CWE-617 CWE-617 Reachable Assertion | CWE-372 CWE-372 Incomplete Internal State Distinction: Send Hold Timer expiry tears down the connection outside the BGP FSM, leaving it in the Established state without a socket
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 57a55968-44ac-464c-a794-6ba3baad09c4 | Secondary | 6 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/C... |
| 4.0 | CNA | CVSS | 6 | MEDIUM | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/AU:N/R:A |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Frrouting | Frrouting | affected 4967bf6d729d7dd14dff7b672b2fd4afe78a0d86 * git | Not specified |
| CNA | Frrouting | Frrouting | affected 10.1.0 10.4.6 semver | Not specified |
| CNA | Frrouting | Frrouting | affected 10.5.0 10.5.6 semver | Not specified |
| CNA | Frrouting | Frrouting | affected 10.6.0 10.6.3 semver | Not specified |
| CNA | Frrouting | Frrouting | affected 10.7.0 10.7.2 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/FRRouting/frr/pull/23945/changes/57a7f3eb48837359d6e3ee5ebd4a... | 57a55968-44ac-464c-a794-6ba3baad09c4 | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Srinivasan Koona Lokabiraman <[email protected]> (not reported as security issue) (en)
CNA: Anthropic OSS-scanner (re-report, ANT-2026-GSLEN9XB) (en)
Additional Advisory Data
Workarounds
CNA: No configuration workaround fully prevents the issue. Monitor bgpd logs for "has not made any SendQ progress for 2 holdtimes" and run "clear bgp <neighbor>" for the affected neighbor, which raises a real FSM event and recovers the peer (this does not prevent the abort when Graceful Restart was negotiated, if the restart timer fires first).