CVE-2026-129217

bgpd: out-of-bounds heap read and crash on NOTIFICATION Cease/Hard Reset with one data byte

Medium 6.0

Description

In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message (RFC 8538). When the data field is exactly one byte long, the function reads one byte past the end of a heap buffer and the 16-bit length of the encapsulated data underflows to 65535, causing a 65535-byte out-of-bounds heap read followed by an assertion failure. A remote BGP peer that has established a session and negotiated the Graceful Restart capability with the Notification (N) bit can send such a message to crash the bgpd daemon, terminating all BGP sessions (denial of service). This is fixed in 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2 and 10.6.0.

Key facts

Published: 13 Nov 2026
Last changed: 13 Nov 2026
Assigned by: NetDEF
EPSS: 0.334% likely to be exploited in the next 30 days, higher than 27.071% of CVEs (scores for 15 Nov 2026)

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

6.0CVSS 4.0, Mediumfrom the CNA (NetDEF)CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N

What to do

Upgrade to a fixed version of FRRoutingCNA solution statement
Graceful Restart Capability needs to be enabled. Disable the Capability with "no bgp graceful-restart notification" or "bgp graceful-restart-disable"CNA workaround statement

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-540 Overread Buffers (CNA impact statement)

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

Vendor	Product	Versions
FRRouting	FRRouting	Default status: unaffected 10.5.0 up to but excluding 10.5.2 (affected) 10.4.0 up to but excluding 10.4.3 (affected) 10.3 up to but excluding 10.3.4 (affected) 10.2 up to but excluding 10.2.6 (affected) 10.1 up to but excluding 10.1.5 (affected) 8.3 up to but excluding 10.0.5 (affected) 0 up to but excluding 8.3 (unaffected)