# CVE-2026-120033: FRRouting bgpd BGP session state inconsistency on Send Hold Timer expiry

Source: https://junglewise.ai/threats/cve-2026-120033-in-frrouting-10-1-and-later-bgpd-does-not-correctly-close-a-bgp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-120033 · Severity: info · Published 2026-11-12

FRRouting's BGP daemon does not properly handle situations where a BGP neighbor stops accepting data but continues sending keepalive messages. This can cause the router to crash if the neighbor supports Graceful Restart, or leave the session incorrectly open and stuck, preventing normal recovery. An overloaded peer device can accidentally trigger this behavior without malicious intent.

Vendors: [Frrouting](https://junglewise.ai/threats/vendors/frrouting).

## Quick answers

**Is CVE-2026-120033 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120033 being exploited in the wild.

**How severe is CVE-2026-120033?** Informational severity, published 12 November 2026.

**Which products and versions are affected?** Frrouting Bgpd 10.1 and later.

**Is there a fix for CVE-2026-120033?** No fixed version is recorded yet. Disable Graceful Restart helper mode if the crash behavior is a concern. Monitor for BGP sessions stuck in the Established state and use "clear bgp" commands to recover when needed. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-120033 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120033?** Check whether you run Frrouting Bgpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable Graceful Restart helper mode if the crash behavior is a concern. Monitor for BGP sessions stuck in the Established state and use "clear bgp" commands to recover when needed.

## Technical details

When the Send Hold Timer (RFC 9687) expires due to a neighbor not accepting outbound data for twice the hold time, bgpd closes the TCP connection but incorrectly maintains the session as established in its state machine. For peers supporting Graceful Restart (enabled by default), this leads to a crash shortly after the restart timeout; without GR support, the session remains stuck, preventing reconnection until manual intervention. Any BGP neighbor with a normal session can trigger this under default timers.

## Affected products

- FRRouting bgpd 10.1 and later

## Timeline

- 2026-11-12: disclosed