Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

BIRD daemon can let peers filter traffic improperly

CVE-2026-112112 · published today
Summary

The BIRD Internet Routing Daemon’s IPv6 flow rules can be tricked, allowing a trusted network partner to add rules that affect traffic outside the intended address range. This could cause unauthorized blocking or redirection of network traffic for downstream users. Update BIRD to the latest version or apply the vendor’s recommended configuration changes to restore proper validation.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
nic bird <= 2.20.0
Original advisory text
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by t...
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.3 Low
Type
CWE-1284Improper Validation of Specified Quantity in Input
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-112112 · NVD
CVE-2026-112112 · MITRE
Track software like this
Free during beta