CVE-2009-2056: Cisco IOS XR

Low severity, CVSS 3.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Cisco IOS XR 3.8.1 and earlier allows remote authenticated users to cause a denial of service (process crash) via vectors involving a BGP UPDATE message with many AS numbers prepended to the AS path.

Affected products

• Cisco IOS XR: up to and including 3.8.1; version 3.0 only; version 3.0.1 only; version 3.1 only; version 3.1.0 only; version 3.2 only; …

Published 2009-08-21. Last modified 2026-06-16.