CVE-2026-112112

LowCVSS 2.3

Published: 18/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD routing daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the authorized range. BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. The rule can pass validation and be propagated to downstream peers.

Risk Assessment

Unauthorized FlowSpec rules may cause traffic filtering or redirection to unauthorized locations, disrupting network service availability. This may lead to traffic hijacking or denial-of-service attacks.

Recommendation

Update BIRD to a version containing the FlowSpec validation fix or disable flow6 validation until the patch is applied. Consider tightening export policies for FlowSpec rules to downstream peers.

Other vulnerabilities in BIRD Internet Routing Daemon

CVE-2026-49943Medium
CZ.NIC BIRD Internet Routing Daemon up to version 2.19.0 has a stack-based buffer overflow in the BGP AS_PATH mask matching implementation. The as_path_match() function uses a fixed-size array, and parse_path() does not limit expanded ASNs, potentially causing a daemon crash. The vendor does not plan a fix.

Original NVD description (English source)

An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS