{"id":"CVE-2026-112112","state":"PUBLISHED","title":"An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address spac","description":"An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.","publishedAt":"2026-10-18T23:01:05.633Z","updatedAt":"2026-10-19T18:41:47.949Z","severity":{"score":2.3,"label":"Low","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","source":"mitre"},"assigner":"mitre","products":["nic BIRD"],"affected":[{"vendor":"nic","product":"BIRD","defaultStatus":"unknown","versions":[{"version":"2.0.9","status":"affected","lessThanOrEqual":"2.20.0","versionType":"semver"},{"version":"3.0.0","status":"affected","lessThanOrEqual":"3.4.0","versionType":"semver"}],"modules":["IPv6 FlowSpec validation"],"programFiles":["nest/rt-table.c"],"programRoutines":[{"name":"net_flow_has_dst_prefix"}],"repo":"https://gitlab.nic.cz/labs/bird"}],"references":["https://gitlab.nic.cz/labs/bird/-/commit/7cf75587b6f38b87849fe192bf5dfd124b7702bc","https://www.rfc-editor.org/rfc/rfc8956.html#section-5","https://gitlab.nic.cz/labs/bird/-/blob/v2.20.0/nest/rt-table.c#L2686","https://gitlab.nic.cz/labs/bird/-/blob/v3.4.0/nest/rt-table.c#L4518"],"weaknesses":["CWE-1284"],"ingestedAt":"2026-10-29T20:10:43.281Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/112xxx/CVE-2026-112112.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-112112","state":"PUBLISHED","datePublished":"2026-10-18T23:01:05.633Z","dateUpdated":"2026-10-19T18:41:47.949Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2026-10-18T23:01:05.103Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection."}],"affected":[{"vendor":"nic","product":"BIRD","defaultStatus":"unknown","versions":[{"version":"2.0.9","status":"affected","lessThanOrEqual":"2.20.0","versionType":"semver"},{"version":"3.0.0","status":"affected","lessThanOrEqual":"3.4.0","versionType":"semver"}],"modules":["IPv6 FlowSpec validation"],"programFiles":["nest/rt-table.c"],"programRoutines":[{"name":"net_flow_has_dst_prefix"}],"repo":"https://gitlab.nic.cz/labs/bird"}],"references":[{"url":"https://gitlab.nic.cz/labs/bird/-/commit/7cf75587b6f38b87849fe192bf5dfd124b7702bc","tags":["patch"]},{"url":"https://www.rfc-editor.org/rfc/rfc8956.html#section-5"},{"url":"https://gitlab.nic.cz/labs/bird/-/blob/v2.20.0/nest/rt-table.c#L2686"},{"url":"https://gitlab.nic.cz/labs/bird/-/blob/v3.4.0/nest/rt-table.c#L4518"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":2.3,"baseSeverity":"LOW","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1284","description":"CWE-1284 Improper Validation of Specified Quantity in Input","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"mitre","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateUpdated":"2026-10-18T23:01:05.633Z"},"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>An established BGP peer must be able to send IPv6 FlowSpec to a receiving flow6 channel configured with \"validate yes\". A suitable unicast route from that peer must be present in the base table. Propagation additionally requires an export policy permitting the rule. Data-plane impact depends on downstream support for, acceptance of, and enforcement of the FlowSpec match and action.</p>"}],"value":"An established BGP peer must be able to send IPv6 FlowSpec to a receiving flow6 channel configured with \"validate yes\". A suitable unicast route from that peer must be present in the base table. Propagation additionally requires an export policy permitting the rule. Data-plane impact depends on downstream support for, acceptance of, and enforcement of the FlowSpec match and action."}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Apply upstream commit 7cf75587b6f38b87849fe192bf5dfd124b7702bc or a verified branch-specific backport. The fix requires the original IPv6 destination-prefix component to have offset zero before it can pass FlowSpec validation. The first fixed release has not yet been verified.</p>"}],"value":"Apply upstream commit 7cf75587b6f38b87849fe192bf5dfd124b7702bc or a verified branch-specific backport. The fix requires the original IPv6 destination-prefix component to have offset zero before it can pass FlowSpec validation. The first fixed release has not yet been verified."}],"x_generator":{"engine":"CVE-Request-form 0.0.1"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:nic:bird:*:*:*:*:*:*:*:*","versionStartIncluding":"2.0.9","versionEndIncluding":"2.20.0"},{"vulnerable":true,"criteria":"cpe:2.3:a:nic:bird:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndIncluding":"3.4.0"}]}]}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-19T18:39:04.870755Z","id":"CVE-2026-112112","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:41:47.949Z"}}]}}}