{"api_version":"1","generated_at":"2026-11-14T23:50:20+00:00","cve":"CVE-2026-129456","urls":{"html":"https://cve.report/CVE-2026-129456","api":"https://cve.report/api/cve/CVE-2026-129456.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-129456","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-129456"},"summary":{"title":"frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs after a malformed attribute length from a peer","description":"In FRRouting, bgpd accepts a Tunnel Encapsulation attribute (type 23) whose outer TLV length does not match the length of the attribute: the mismatch is only logged and the attribute is processed anyway. A BGP neighbor can send UPDATE messages carrying such an attribute that put the reference count of the attribute's interned sub-TLV chain out of balance, so that the chain is freed while routes stored by bgpd (Adj-RIB-In entries and RIB paths) still point to it. When those routes are later replaced, withdrawn or cleared, for example when the session goes down, bgpd reads the freed memory, decrements a reference count inside it and frees it a second time. In the reporter's build without AddressSanitizer this ended in an assertion failure in bgpd's memory accounting, aborting bgpd and dropping all BGP sessions on the router, and the neighbor can repeat it each time bgpd restarts. Because freed heap memory is written to and freed again, consequences beyond a crash cannot be ruled out. An established BGP session is required. bgpd processes attribute 23 from every neighbor, including eBGP neighbors, unless it is explicitly discarded, although RFC 9012 requires it to be filtered on eBGP sessions by default. The issue was reproduced with \"soft-reconfiguration inbound\" configured for the neighbor, and the reporter observed that the crash does not occur on every attempt.","state":"PUBLISHED","assigner":"NetDEF","published_at":"2026-11-14 20:17:40","updated_at":"2026-11-14 20:17:40"},"problem_types":["CWE-415","CWE-416","CWE-416 CWE-416 Use After Free: the interned Tunnel Encapsulation sub-TLV chain is freed while stored routes still reference it, and encap_unintern() later reads and decrements its reference count","CWE-415 CWE-415 Double Free"],"metrics":[{"version":"4.0","source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary","score":"7.7","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"AUTOMATIC","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"7.7","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:N/R:A","data":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:N/R:A","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}}],"references":[{"url":"https://github.com/FRRouting/frr/commit/bebf95f02bc0dccc6a1841f0c8cbcba1f617d655","name":"https://github.com/FRRouting/frr/commit/bebf95f02bc0dccc6a1841f0c8cbcba1f617d655","refsource":"57a55968-44ac-464c-a794-6ba3baad09c4","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/FRRouting/frr/commit/abef07b500e19baa924d157ab03809b93730e619","name":"https://github.com/FRRouting/frr/commit/abef07b500e19baa924d157ab03809b93730e619","refsource":"57a55968-44ac-464c-a794-6ba3baad09c4","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/FRRouting/frr/pull/21176/changes/1238ac4a06e5c23595e8bf626856f297d0c302a2","name":"https://github.com/FRRouting/frr/pull/21176/changes/1238ac4a06e5c23595e8bf626856f297d0c302a2","refsource":"57a55968-44ac-464c-a794-6ba3baad09c4","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/FRRouting/frr/issues/20874","name":"https://github.com/FRRouting/frr/issues/20874","refsource":"57a55968-44ac-464c-a794-6ba3baad09c4","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-129456","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129456","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"frrouting","product":"frrouting","version":"affected f4c89855b594d4b32bb3610537703215c978440e * git","platforms":[]},{"source":"CNA","vendor":"frrouting","product":"frrouting","version":"affected 10.4.0 10.4.4 semver","platforms":[]},{"source":"CNA","vendor":"frrouting","product":"frrouting","version":"affected 10.5.0 10.5.4 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Configure \"neighbor <neighbor> path-attribute discard 23\" (or \"neighbor <neighbor> path-attribute treat-as-withdraw 23\") for neighbors that are not expected to send the Tunnel Encapsulation attribute, in particular all eBGP neighbors. bgpd then skips the attribute without parsing it.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"Fault Chain (https://faultchain.com/)","lang":"en"},{"source":"CNA","value":"Donatas Abraitis <donatas@opensourcerouting.org>","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","modules":["bgpd"],"product":"frrouting","programFiles":["bgpd/bgp_attr.c"],"programRoutines":[{"name":"bgp_attr_encap"},{"name":"encap_unintern"}],"repo":"https://github.com/FRRouting/frr/","vendor":"frrouting","versions":[{"changes":[{"at":"1238ac4a06e5c23595e8bf626856f297d0c302a2","status":"unaffected"}],"lessThan":"*","status":"affected","version":"f4c89855b594d4b32bb3610537703215c978440e","versionType":"git"},{"lessThan":"10.4.4","status":"affected","version":"10.4.0","versionType":"semver"},{"lessThan":"10.5.4","status":"affected","version":"10.5.0","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*","versionEndExcluding":"10.4.4","versionStartIncluding":"10.4.0","vulnerable":true},{"criteria":"cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*","versionEndExcluding":"10.5.4","versionStartIncluding":"10.5.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"reporter","value":"Fault Chain (https://faultchain.com/)"},{"lang":"en","type":"remediation developer","value":"Donatas Abraitis <donatas@opensourcerouting.org>"}],"descriptions":[{"lang":"en","value":"In FRRouting, bgpd accepts a Tunnel Encapsulation attribute (type 23) whose outer TLV length does not match the length of the attribute: the mismatch is only logged and the attribute is processed anyway. A BGP neighbor can send UPDATE messages carrying such an attribute that put the reference count of the attribute's interned sub-TLV chain out of balance, so that the chain is freed while routes stored by bgpd (Adj-RIB-In entries and RIB paths) still point to it. When those routes are later replaced, withdrawn or cleared, for example when the session goes down, bgpd reads the freed memory, decrements a reference count inside it and frees it a second time. In the reporter's build without AddressSanitizer this ended in an assertion failure in bgpd's memory accounting, aborting bgpd and dropping all BGP sessions on the router, and the neighbor can repeat it each time bgpd restarts. Because freed heap memory is written to and freed again, consequences beyond a crash cannot be ruled out. An established BGP session is required. bgpd processes attribute 23 from every neighbor, including eBGP neighbors, unless it is explicitly discarded, although RFC 9012 requires it to be filtered on eBGP sessions by default. The issue was reproduced with \"soft-reconfiguration inbound\" configured for the neighbor, and the reporter observed that the crash does not occur on every attempt."}],"metrics":[{"cvssV4_0":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:N/R:A","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"CWE-416 Use After Free: the interned Tunnel Encapsulation sub-TLV chain is freed while stored routes still reference it, and encap_unintern() later reads and decrements its reference count","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-415","description":"CWE-415 Double Free","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-14T19:13:23.983Z","orgId":"57a55968-44ac-464c-a794-6ba3baad09c4","shortName":"NetDEF"},"references":[{"tags":["issue-tracking"],"url":"https://github.com/FRRouting/frr/issues/20874"},{"tags":["patch"],"url":"https://github.com/FRRouting/frr/pull/21176/changes/1238ac4a06e5c23595e8bf626856f297d0c302a2"},{"tags":["patch"],"url":"https://github.com/FRRouting/frr/commit/bebf95f02bc0dccc6a1841f0c8cbcba1f617d655"},{"tags":["patch"],"url":"https://github.com/FRRouting/frr/commit/abef07b500e19baa924d157ab03809b93730e619"}],"source":{"discovery":"EXTERNAL"},"title":"frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs after a malformed attribute length from a peer","workarounds":[{"lang":"en","value":"Configure \"neighbor <neighbor> path-attribute discard 23\" (or \"neighbor <neighbor> path-attribute treat-as-withdraw 23\") for neighbors that are not expected to send the Tunnel Encapsulation attribute, in particular all eBGP neighbors. bgpd then skips the attribute without parsing it."}],"x_generator":{"engine":"vim"}}},"cveMetadata":{"assignerOrgId":"57a55968-44ac-464c-a794-6ba3baad09c4","assignerShortName":"NetDEF","cveId":"CVE-2026-129456","datePublished":"2026-11-14T19:13:23.983Z","dateReserved":"2026-11-14T19:03:34.352Z","dateUpdated":"2026-11-14T19:13:23.983Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-14 20:17:40","lastModifiedDate":"2026-11-14 20:17:40","problem_types":["CWE-415","CWE-416","CWE-416 CWE-416 Use After Free: the interned Tunnel Encapsulation sub-TLV chain is freed while stored routes still reference it, and encap_unintern() later reads and decrements its reference count","CWE-415 CWE-415 Double Free"],"metrics":{"cvssMetricV40":[{"source":"57a55968-44ac-464c-a794-6ba3baad09c4","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:A/V:X/RE:X/U:X","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"HIGH","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NO","Recovery":"AUTOMATIC","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"129456","Ordinal":"1","Title":"frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs after ","CVE":"CVE-2026-129456","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"129456","Ordinal":"1","NoteData":"In FRRouting, bgpd accepts a Tunnel Encapsulation attribute (type 23) whose outer TLV length does not match the length of the attribute: the mismatch is only logged and the attribute is processed anyway. A BGP neighbor can send UPDATE messages carrying such an attribute that put the reference count of the attribute's interned sub-TLV chain out of balance, so that the chain is freed while routes stored by bgpd (Adj-RIB-In entries and RIB paths) still point to it. When those routes are later replaced, withdrawn or cleared, for example when the session goes down, bgpd reads the freed memory, decrements a reference count inside it and frees it a second time. In the reporter's build without AddressSanitizer this ended in an assertion failure in bgpd's memory accounting, aborting bgpd and dropping all BGP sessions on the router, and the neighbor can repeat it each time bgpd restarts. Because freed heap memory is written to and freed again, consequences beyond a crash cannot be ruled out. An established BGP session is required. bgpd processes attribute 23 from every neighbor, including eBGP neighbors, unless it is explicitly discarded, although RFC 9012 requires it to be filtered on eBGP sessions by default. The issue was reproduced with \"soft-reconfiguration inbound\" configured for the neighbor, and the reporter observed that the crash does not occur on every attempt.","Type":"Description","Title":"frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs after "}]}}}