{"api_version":"1","generated_at":"2026-11-14T23:50:26+00:00","cve":"CVE-2026-120033","urls":{"html":"https://cve.report/CVE-2026-120033","api":"https://cve.report/api/cve/CVE-2026-120033.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-120033","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-120033"},"summary":{"title":"frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a phantom Established session or crashing bgpd with Graceful Restart","description":"In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending KEEPALIVEs but stops reading from its connection, at a time when the router has a large amount of data to send to it (for example while sending it a full routing table), can trigger this. If the neighbor announced Graceful Restart support, bgpd crashes shortly after the session is closed, taking down all BGP sessions on the router, and the neighbor can repeat this each time bgpd restarts. Otherwise, the session stays stuck in the Established state: the neighbor's routes stay installed and keep being advertised to other peers, and the neighbor cannot reconnect until an operator clears the session manually. The neighbor does not need to be malicious; an overloaded or stuck peer can trigger the same behavior. No special configuration is required: any established BGP neighbor can trigger the issue, and Graceful Restart helper mode, which leads to the crash, is enabled by default.","state":"PUBLISHED","assigner":"NetDEF","published_at":"2026-11-12 19:16:48","updated_at":"2026-11-14 15:16:57"},"problem_types":["CWE-372","CWE-617","CWE-617 CWE-617 Reachable Assertion","CWE-372 CWE-372 Incomplete Internal State Distinction: Send Hold Timer expiry tears down the connection outside the BGP FSM, leaving it in the Established state without a socket"],"metrics":[{"version":"4.0","source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary","score":"6","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X","baseScore":6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"AUTOMATIC","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"6","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/AU:N/R:A","data":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":6,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/AU:N/R:A","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"}}],"references":[{"url":"https://github.com/FRRouting/frr/pull/23945/changes/57a7f3eb48837359d6e3ee5ebd4acea8f49320e5","name":"https://github.com/FRRouting/frr/pull/23945/changes/57a7f3eb48837359d6e3ee5ebd4acea8f49320e5","refsource":"57a55968-44ac-464c-a794-6ba3baad09c4","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120033","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120033","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"frrouting","product":"frrouting","version":"affected 4967bf6d729d7dd14dff7b672b2fd4afe78a0d86 * git","platforms":[]},{"source":"CNA","vendor":"frrouting","product":"frrouting","version":"affected 10.1.0 10.4.6 semver","platforms":[]},{"source":"CNA","vendor":"frrouting","product":"frrouting","version":"affected 10.5.0 10.5.6 semver","platforms":[]},{"source":"CNA","vendor":"frrouting","product":"frrouting","version":"affected 10.6.0 10.6.3 semver","platforms":[]},{"source":"CNA","vendor":"frrouting","product":"frrouting","version":"affected 10.7.0 10.7.2 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"No configuration workaround fully prevents the issue. Monitor bgpd logs for \"has not made any SendQ progress for 2 holdtimes\" and run \"clear bgp <neighbor>\" for the affected neighbor, which raises a real FSM event and recovers the peer (this does not prevent the abort when Graceful Restart was negotiated, if the restart timer fires first).","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Srinivasan Koona Lokabiraman <srinivasan@nexthop.ai> (not reported as security issue)","lang":"en"},{"source":"CNA","value":"Anthropic OSS-scanner (re-report, ANT-2026-GSLEN9XB)","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"120033","cve":"CVE-2026-120033","epss":"0.002940000","percentile":"0.222330000","score_date":"2026-11-13","updated_at":"2026-11-14 00:10:19"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","modules":["bgpd"],"product":"frrouting","programFiles":["bgpd/bgp_fsm.c"],"programRoutines":[{"name":"bgp_event_stop_with_notify"}],"repo":"https://github.com/FRRouting/frr/","vendor":"frrouting","versions":[{"changes":[{"at":"57a7f3eb48837359d6e3ee5ebd4acea8f49320e5","status":"unaffected"}],"lessThan":"*","status":"affected","version":"4967bf6d729d7dd14dff7b672b2fd4afe78a0d86","versionType":"git"},{"lessThan":"10.4.6","status":"affected","version":"10.1.0","versionType":"semver"},{"lessThan":"10.5.6","status":"affected","version":"10.5.0","versionType":"semver"},{"lessThan":"10.6.3","status":"affected","version":"10.6.0","versionType":"semver"},{"lessThan":"10.7.2","status":"affected","version":"10.7.0","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*","versionEndExcluding":"10.4.6","versionStartIncluding":"10.1.0","vulnerable":true},{"criteria":"cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*","versionEndExcluding":"10.5.6","versionStartIncluding":"10.5.0","vulnerable":true},{"criteria":"cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6.3","versionStartIncluding":"10.6.0","vulnerable":true},{"criteria":"cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*","versionEndExcluding":"10.7.2","versionStartIncluding":"10.7.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"reporter","value":"Srinivasan Koona Lokabiraman <srinivasan@nexthop.ai> (not reported as security issue)"},{"lang":"en","type":"tool","value":"Anthropic OSS-scanner (re-report, ANT-2026-GSLEN9XB)"}],"descriptions":[{"lang":"en","value":"In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending KEEPALIVEs but stops reading from its connection, at a time when the router has a large amount of data to send to it (for example while sending it a full routing table), can trigger this. If the neighbor announced Graceful Restart support, bgpd crashes shortly after the session is closed, taking down all BGP sessions on the router, and the neighbor can repeat this each time bgpd restarts. Otherwise, the session stays stuck in the Established state: the neighbor's routes stay installed and keep being advertised to other peers, and the neighbor cannot reconnect until an operator clears the session manually. The neighbor does not need to be malicious; an overloaded or stuck peer can trigger the same behavior. No special configuration is required: any established BGP neighbor can trigger the issue, and Graceful Restart helper mode, which leads to the crash, is enabled by default."}],"metrics":[{"cvssV4_0":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":6,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/AU:N/R:A","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-617","description":"CWE-617 Reachable Assertion","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-372","description":"CWE-372 Incomplete Internal State Distinction: Send Hold Timer expiry tears down the connection outside the BGP FSM, leaving it in the Established state without a socket","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-14T14:46:55.176Z","orgId":"57a55968-44ac-464c-a794-6ba3baad09c4","shortName":"NetDEF"},"references":[{"tags":["patch"],"url":"https://github.com/FRRouting/frr/pull/23945/changes/57a7f3eb48837359d6e3ee5ebd4acea8f49320e5"}],"source":{"discovery":"UNKNOWN"},"title":"frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a phantom Established session or crashing bgpd with Graceful Restart","workarounds":[{"lang":"en","value":"No configuration workaround fully prevents the issue. Monitor bgpd logs for \"has not made any SendQ progress for 2 holdtimes\" and run \"clear bgp <neighbor>\" for the affected neighbor, which raises a real FSM event and recovers the peer (this does not prevent the abort when Graceful Restart was negotiated, if the restart timer fires first)."}],"x_generator":{"engine":"vim"}}},"cveMetadata":{"assignerOrgId":"57a55968-44ac-464c-a794-6ba3baad09c4","assignerShortName":"NetDEF","cveId":"CVE-2026-120033","datePublished":"2026-11-12T18:07:42.693Z","dateReserved":"2026-10-30T18:11:52.731Z","dateUpdated":"2026-11-14T14:46:55.176Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 19:16:48","lastModifiedDate":"2026-11-14 15:16:57","problem_types":["CWE-372","CWE-617","CWE-617 CWE-617 Reachable Assertion","CWE-372 CWE-372 Incomplete Internal State Distinction: Send Hold Timer expiry tears down the connection outside the BGP FSM, leaving it in the Established state without a socket"],"metrics":{"cvssMetricV40":[{"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X","baseScore":6,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"LOW","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"AUTOMATIC","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"120033","Ordinal":"1","Title":"frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a pha","CVE":"CVE-2026-120033","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"120033","Ordinal":"1","NoteData":"In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending KEEPALIVEs but stops reading from its connection, at a time when the router has a large amount of data to send to it (for example while sending it a full routing table), can trigger this. If the neighbor announced Graceful Restart support, bgpd crashes shortly after the session is closed, taking down all BGP sessions on the router, and the neighbor can repeat this each time bgpd restarts. Otherwise, the session stays stuck in the Established state: the neighbor's routes stay installed and keep being advertised to other peers, and the neighbor cannot reconnect until an operator clears the session manually. The neighbor does not need to be malicious; an overloaded or stuck peer can trigger the same behavior. No special configuration is required: any established BGP neighbor can trigger the issue, and Graceful Restart helper mode, which leads to the crash, is enabled by default.","Type":"Description","Title":"frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a pha"}]}}}