PT-2026-45806 · Nic · Bird
Published
2026-06-02
·
Updated
2026-06-02
·
CVE-2026-49943
CVSS v3.1
6.3
Medium
| Vector | AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H |
CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS PATH mask matching implementation in nest/a-path.c. The as path match() function uses a fixed-size stack array of 2048 + 1 pm pos entries, while parse path() expands AS PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as "bgp path ~ [= ... =]", an established BGP peer can send a long AS PATH containing more than 2048 expanded ASNs. This causes parse path()/as path match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.
Fix
Stack Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Bird