The bgp_capability_orf function in bgpd in Quagga 0.99.20.1 and earlier allows remote attackers to cause a denial of service by leveraging a BGP peering relationship and sending a malformed Outbound Route Filtering capability TLV in an OPEN message.