CVE-2026-129456

Name of the Vulnerable Software and Affected Versions FRRouting (affected versions not specified)

Description In bgpd, the process accepts a Tunnel Encapsulation attribute (type 23) where the outer TLV (Type-Length-Value) length does not match the actual attribute length. This mismatch causes the reference count of the attribute's interned sub-TLV chain to become unbalanced, leading to the chain being freed while routes in the Adj-RIB-In entries and RIB paths still reference it. When these routes are replaced, withdrawn, or cleared, bgpd accesses the freed memory and attempts to free it a second time. This double-free condition can lead to an assertion failure in memory accounting, causing bgpd to abort and drop all BGP sessions. The issue requires an established BGP session and can be triggered by any neighbor, including eBGP neighbors, unless the attribute is explicitly discarded.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.