{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-129456","assignerOrgId":"57a55968-44ac-464c-a794-6ba3baad09c4","state":"PUBLISHED","assignerShortName":"NetDEF","dateReserved":"2026-11-14T19:03:34.352Z","datePublished":"2026-11-14T19:13:23.983Z","dateUpdated":"2026-11-15T18:05:07.191Z"},"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","modules":["bgpd"],"product":"frrouting","programFiles":["bgpd/bgp_attr.c"],"programRoutines":[{"name":"bgp_attr_intern"},{"name":"encap_unintern"}],"repo":"https://github.com/FRRouting/frr/","vendor":"frrouting","versions":[{"changes":[{"at":"40f25e62686865649b7631ec30756f9661e12dd3","status":"unaffected"}],"lessThan":"*","status":"affected","version":"97dd9ea9e3e2aa982dcbc36466573eb4c0c87cbd","versionType":"git"},{"lessThan":"10.6.2","status":"affected","version":"10.6.0","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frrouting:frrouting:*:*:*:*:*:*:*:*","versionEndExcluding":"10.6.2","versionStartIncluding":"10.6.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"reporter","value":"Fault Chain (https://faultchain.com/)"},{"lang":"en","type":"reporter","value":"Bronson Yen <bronson@calif.io>"},{"lang":"en","type":"remediation developer","value":"Mark Stapp <mjs@cisco.com>"}],"descriptions":[{"lang":"en","value":"In FRRouting, bgpd frees the sub-TLV chain of a Tunnel Encapsulation attribute (type 23) while routes stored by bgpd still point to it, if the attribute is received from a neighbor that has \"soft-reconfiguration inbound\" configured. A cache added to speed up attribute interning while processing the prefixes of an UPDATE checks whether an interned attribute set may be reused by comparing the parsed attributes with themselves, so the check always succeeds. Interning the parsed attributes for the Adj-RIB-In removes the Tunnel Encapsulation sub-TLVs from them, and the copy that bgpd then interns for the route reuses the cached attribute set, which still holds the sub-TLVs, without taking a reference on them. When the route is later replaced, withdrawn or cleared, for example when the session goes down, the sub-TLV chain is freed while still in use, and bgpd then reads it, decrements a reference count inside it and frees it a second time. In the reporter's build without AddressSanitizer this ended in an assertion failure in bgpd's memory accounting, aborting bgpd and dropping all BGP sessions on the router, and the neighbor can repeat it each time bgpd restarts. Because freed heap memory is written to and freed again, consequences beyond a crash cannot be ruled out. An established BGP session is required, and the attribute does not need to be malformed. bgpd processes attribute 23 from every neighbor, including eBGP neighbors, unless it is explicitly discarded, although RFC 9012 requires it to be filtered on eBGP sessions by default. Neighbors without \"soft-reconfiguration inbound\" are not affected."}],"metrics":[{"cvssV4_0":{"Automatable":"NO","Recovery":"AUTOMATIC","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:N/R:A","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","description":"CWE-416 Use After Free: the attribute intern reuse cache returns an interned attribute set holding the Tunnel Encapsulation sub-TLV chain without taking a reference on the chain, which is then freed while still referenced and later accessed by encap_unintern()","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-415","description":"CWE-415 Double Free","lang":"en","type":"CWE"}]}],"providerMetadata":{"orgId":"57a55968-44ac-464c-a794-6ba3baad09c4","shortName":"NetDEF","dateUpdated":"2026-11-15T18:05:07.191Z"},"references":[{"tags":["issue-tracking"],"url":"https://github.com/FRRouting/frr/issues/20874"},{"tags":["patch"],"url":"https://github.com/FRRouting/frr/pull/22008/changes/40f25e62686865649b7631ec30756f9661e12dd3"},{"tags":["patch"],"url":"https://github.com/FRRouting/frr/commit/5c241056777b27b209bc89326f0061ec6d5e0924"}],"source":{"discovery":"EXTERNAL"},"title":"frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs via the attribute intern reuse cache with soft-reconfiguration inbound","workarounds":[{"lang":"en","value":"Remove \"neighbor <neighbor> soft-reconfiguration inbound\", or configure \"neighbor <neighbor> path-attribute discard 23\" (or \"neighbor <neighbor> path-attribute treat-as-withdraw 23\") for neighbors that are not expected to send the Tunnel Encapsulation attribute, in particular all eBGP neighbors. With the attribute discarded, bgpd skips it without parsing or storing it."}],"x_generator":{"engine":"vim"}}}}