NetDEF's record says an established BGP neighbor can cause bgpd to crash and drop the router's BGP sessions. Inventory affected peers and running versions before deciding where to apply the April 2026 fixes.The observed outcome was a bgpd abort, with a repeat possible after restart. The record does not establish remote code execution. A vulnerability intelligence platform can support the inventory and patch decision, while the neighbor prerequisite remains central to exposure.
What it allows
How Can CVE-2026-129456 Disrupt BGP Sessions?
According to NetDEF, bgpd logs a mismatch between the outer TLV length and the Tunnel Encapsulation attribute length, then processes the attribute. A neighbor with an established BGP session can send an UPDATE that unbalances references to the attribute's interned sub-TLV chain. Stored routes can still point to the chain after bgpd frees it.
Later route replacement, withdrawal, or clearing can make bgpd read the freed chain and free it again. The reporter observed an assertion failure and bgpd abort without AddressSanitizer, which dropped all sessions on that router. The reporter reproduced the issue with inbound soft reconfiguration enabled, but said the crash did not happen on every attempt.
How Should Teams Judge the Risk?
The required established session limits who can reach this path. NetDEF says bgpd processes attribute 23 from every neighbor, including eBGP neighbors, unless an operator explicitly discards it. The record also says RFC 9012 calls for default filtering on eBGP sessions.
NetDEF rates the issue CVSS 4.0 7.7 High. The record says effects beyond a crash cannot be ruled out because freed heap memory is written and freed again; it does not confirm such effects.
Who is affected
Version Check
| Release Line | Affected Range | Fixed In |
|---|---|---|
| 10.4.x | 10.4.0 to before 10.4.4 | 10.4.4 |
| 10.5.x | 10.5.0 to before 10.5.4 | 10.5.4 |
For distribution packages and custom builds, check the supplier’s advisory.
Compare upstream FRRouting releases. Distribution packages may carry backported fixes; verify their changelog manually.
Which FRRouting Versions Are Affected by CVE-2026-129456?
NetDEF lists FRRouting bgpd 10.4.0 through 10.4.3 and 10.5.0 through 10.5.3 as affected. Its version ranges end before 10.4.4 and 10.5.4, respectively. FRRouting's April 23, 2026 release notes for both fixed versions list the Tunnel Encapsulation use-after-free correction.
Inventory routers running bgpd, their exact FRRouting builds, and their established BGP neighbors. Record which peers are permitted to send Tunnel Encapsulation attributes and whether inbound soft reconfiguration is enabled. The reporter's reproduction used that setting; the record does not say it is a universal prerequisite.
What Should Operators Fix and Verify?
Upgrade affected 10.4 deployments to 10.4.4 or a later fixed build in that branch, and affected 10.5 deployments to 10.5.4 or later. Prioritize routers whose BGP sessions are critical and whose peers can send the attribute. Check your distribution's package changelog if its version string does not match upstream FRRouting releases.
For neighbors not expected to send Tunnel Encapsulation, NetDEF documents a configuration that discards BGP path attribute 23 or treats it as withdrawn. Validate the policy with the routing owner before applying it, because legitimate attribute use could change. After maintenance, confirm each running bgpd version, review peer policy, and monitor process restarts and session resets. Record those checks in the patch management process.
Timeline
- 2026-04-23
FRRouting published 10.4.4 and 10.5.4 release notes listing the bgpd Tunnel Encapsulation use-after-free fix.
- 2026-11-14
NetDEF published CVE-2026-129456, describing affected ranges and the reporter's observed bgpd crash.
What to do
-
Inventory bgpd and BGP neighbors
Record the running FRRouting version and every established BGP peer. Identify peers allowed to send Tunnel Encapsulation attributes and note inbound soft reconfiguration.
-
Prioritize affected builds
Flag upstream 10.4.0 to 10.4.3 and 10.5.0 to 10.5.3. Confirm distribution backports from the package changelog before classifying a vendor build.
-
Upgrade or limit attribute processing
Move the affected branch to upstream 10.4.4 or 10.5.4, respectively, or a later fixed build. For peers not expected to use attribute 23, assess NetDEF's documented discard or treat-as-withdraw policy.
-
Verify the running fix
Confirm the version of each running bgpd process after maintenance. Review peer policy and watch for bgpd restarts or BGP session resets.
What Brandefense can do
- Watch your stack for exploited flaws
Name the vendors and products you run, and Brandefense alerts you when a CVE in them is exploited.
- Vulnerability intelligence platform
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
Can an unauthenticated internet host trigger CVE-2026-129456?
NetDEF says an established BGP session is required. Operators should identify configured peers and their attribute policies before assessing exposure.
Which FRRouting versions include the fix?
The CVE ranges end before 10.4.4 and 10.5.4. FRRouting's April 23, 2026 release notes list the correction in both releases.
Does the CVE prove remote code execution?
No. The reporter observed a bgpd crash and session loss. NetDEF says effects beyond a crash cannot be ruled out, but does not establish them.
Is inbound soft reconfiguration required?
The reporter reproduced the flaw with inbound soft reconfiguration configured. NetDEF does not state that it is necessary for every affected deployment.
Sources
- CVE-2026-129456 NetDEF CNA RecordNetDEF via CVE Program
- FRRouting Release 10.4.4FRRouting
- FRRouting Release 10.5.4FRRouting
