Threats tagged 'ghsa-m8qq-j9p2-w4x8'

FRRouting's bgpd daemon improperly processes a Tunnel Encapsulation attribute (type 23) with a mismatched outer TLV length, leading to reference count imbalances and use-after-free conditions. This can cause bgpd to abort and drop all BGP sessions, requiring a restart. The vulnerability requires an established BGP session and can be triggered repeatedly by a neighbor sending crafted UPDATE messages. The issue affects both iBGP and eBGP neighbors unless the attribute is explicitly discarded. Crashes do not occur on every attempt but can be reliably reproduced with certain configurations.