Attribute 40 is the prefix SID attribute, from segment routing. It's valid for VPN address families but not for regular IPv4/IPv6 unicast. On those families it should just be passed as optional transitive. Juniper fixed a bug earlier this year where their routers were mangling this attribute when the ingress router readvertised it as a VPN route. CVE-2025-60011 I've also seen a prefix from a DOD AS with this attribute recently. Regards, Ryan -------- Original Message -------- On Wednesday, 06/17/26 at 05:18 Drew Weaver via NANOG <nanog@lists.nanog.org> wrote: Howdy, I'm mostly just curious I've seen things like this before but more in the past 16 hours. Are other folks seeing these? Malformed UPDATE message received from neighbor (Lumen) (VRF: default) - message length 189 bytes, error flags 0x00000080, action taken "TreatAsWdr". Error details: "Error 0x00000080, Field "Attr-length", Attribute 40 (Flags 0xc0, Length 37), Data [c0282500]". NLRIs: [IPv4 Unicast] 55.27.156.0/24<http://55.27.156.0/24> 55.27.184.0/24<http://55.27.184.0/24> 55.74.158.0/24<http://55.74.158.0/24> 55.74.157.0/24<http://55.74.157.0/24> 55.67.156.0/24<http://55.67.156.0/24> 55.74.156.0/24<http://55.74.156.0/24> I'm wondering because it could be that the update itself is fine but my router cannot interpret it properly. Thanks everyone, sorry for noise. -Drew _______________________________________________ NANOG mailing list https://lists.nanog.org/archives/list/nanog@lists.nanog.org/message/CO4CKBL3...