CVE-2026-129456— FRR bgpd 隧道封装子TLV释放后使用漏洞
一分钟漏洞结论
影响对象
frrouting frrouting
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 FRRouting 中，bgpd 进程会接受隧道封装属性（Tunnel Encapsulation attribute，类型 23），即使该属性的外层 TLV 长度与属性实际长度不匹配。这种不一致仅会被记录日志，但属性仍会被正常处理。攻击者控制的 BGP 邻居可以发送包含此类属性的 UPDATE 消息，导致该属性内部化（interned）的子 TLV 链的引用计数失去平衡，从而使得该链在被 bgpd 存储的路由（包括 Adj-RIB-In 条目和 RIB 路径）仍然指向它时就被释放。当这些路由随后被替换、撤销或
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-129456 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs via the attribute intern reuse cache with soft-reconfiguration inbound
来源: CVE Program / CVE List V5
Vulnerability Description
In FRRouting, bgpd frees the sub-TLV chain of a Tunnel Encapsulation attribute (type 23) while routes stored by bgpd still point to it, if the attribute is received from a neighbor that has "soft-reconfiguration inbound" configured. A cache added to speed up attribute interning while processing the prefixes of an UPDATE checks whether an interned attribute set may be reused by comparing the parsed attributes with themselves, so the check always succeeds. Interning the parsed attributes for the Adj-RIB-In removes the Tunnel Encapsulation sub-TLVs from them, and the copy that bgpd then interns for the route reuses the cached attribute set, which still holds the sub-TLVs, without taking a reference on them. When the route is later replaced, withdrawn or cleared, for example when the session goes down, the sub-TLV chain is freed while still in use, and bgpd then reads it, decrements a reference count inside it and frees it a second time. In the reporter's build without AddressSanitizer this ended in an assertion failure in bgpd's memory accounting, aborting bgpd and dropping all BGP sessions on the router, and the neighbor can repeat it each time bgpd restarts. Because freed heap memory is written to and freed again, consequences beyond a crash cannot be ruled out. An established BGP session is required, and the attribute does not need to be malformed. bgpd processes attribute 23 from every neighbor, including eBGP neighbors, unless it is explicitly discarded, although RFC 9012 requires it to be filtered on eBGP sessions by default. Neighbors without "soft-reconfiguration inbound" are not affected.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:L/AU:N/R:A
来源: CVE Program / CVE List V5
Vulnerability Type
释放后使用
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-129456 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-129456 的情报信息
请登录查看更多情报信息。