CVE-2026-112112 in BIRD
Summary
by MITRE • 10/19/2026
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/19/2026
The vulnerability identified in CZ.NIC BIRD Internet Routing Daemon represents a critical failure in the implementation of IPv6 Flow Specification (FlowSpec) validation mechanisms as defined by RFC 8956. This flaw specifically affects systems where unicast route validation is enabled on the receiving flow6 channel, allowing an established Border Gateway Protocol peer to inject malicious or erroneous FlowSpec rules that target destination prefixes outside the authorized address space. The core technical deficiency lies in how BIRD processes the prefix component of IPv6 FlowSpec updates when a nonzero offset is present within the rule structure. According to RFC 8956 section 5, such constructs should be strictly rejected if they do not align with valid unicast routing prefixes or if they attempt to match address ranges that are not authorized by the local validation policies. However, BIRD incorrectly validates these rules by reconstructing a prefix where the bits corresponding to the nonzero offset are zero-filled. This reconstruction logic fundamentally alters the semantic meaning of the original FlowSpec component, effectively narrowing the matched address range in the internal representation while allowing the rule to pass validation checks that should have failed due to misalignment with authorized unicast routes.
From an operational perspective, this bypass enables a BGP peer to propagate traffic filtering or redirection rules that target IPv6 addresses not permitted under the current routing policy configuration. When these improperly validated FlowSpec rules are accepted and subsequently exported to downstream peers based on local export policies, they can trigger unauthorized network actions across multiple autonomous systems. The immediate impact includes potential denial of service through aggressive traffic blackholing or misdirection of legitimate user traffic to unintended destinations. This undermines the integrity of inter-domain routing security models that rely on accurate validation of both unicast and multicast flow specifications to prevent route hijacking and malicious filtering. The vulnerability exploits the trust relationship between BGP peers, allowing a single compromised or misconfigured peer to influence traffic engineering decisions across a broader network topology without proper authorization checks being enforced at the point of ingress.
This issue aligns with CWE-20 Improper Input Validation, as the software fails to correctly validate input data against expected structural and semantic constraints defined by relevant standards. Furthermore, it relates to CWE-787 Out-of-bounds Write in a broader conceptual sense regarding memory or state manipulation during prefix reconstruction, though more accurately it falls under logic errors leading to unauthorized access or control over network resources. In the context of the MITRE ATT&CK framework for enterprise security, this vulnerability facilitates techniques associated with Network Traffic Hijacking and potentially Denial of Service via traffic redirection. Attackers can leverage this flaw to disrupt service availability or intercept sensitive communications by manipulating how flow specifications are interpreted and enforced within the routing infrastructure.
Mitigation strategies must focus on ensuring that all IPv6 FlowSpec implementations strictly adhere to RFC 8956 requirements regarding prefix validation, particularly concerning offset handling and unicast route correlation. Administrators should verify their BIRD configurations for any custom modifications or outdated versions susceptible to this logic error and apply vendor-provided patches as soon as they become available. Additionally, network operators should implement strict filtering policies at the edge of autonomous systems to reject FlowSpec updates that do not correspond precisely with authorized unicast prefixes, including rigorous checks on prefix length consistency and offset validity. Regular auditing of BGP session configurations and flow specification rules can help detect anomalies indicative of such exploitation attempts before they propagate downstream.