CVE-2026-120033

Name of the Vulnerable Software and Affected Versions FRRouting versions 10.1 and later

Description The bgpd process fails to correctly close a BGP session upon the expiration of the Send Hold Timer (RFC 9687), which occurs when a neighbor stops accepting data for twice the hold time. While the connection is closed, bgpd continues to treat the session as active. This can be triggered by a neighbor that continues sending KEEPALIVEs but stops reading data, particularly when the router is sending large amounts of data such as a full routing table. If the neighbor supports Graceful Restart, bgpd crashes shortly after the session closes, disrupting all BGP sessions on the router. If Graceful Restart is not supported, the session remains stuck in the Established state, causing the neighbor's routes to remain installed and advertised to other peers, preventing reconnection until the session is manually cleared. This behavior can be triggered by an overloaded or stuck peer and does not require malicious intent.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.