Vulnerability-Lookup

GHSA-6JP9-P482-X6C9

Vulnerability from github – Published: 2026-10-19 00:30 – Updated: 2026-10-19 00:30

Details

An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.

Severity

2.3 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-112112"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-18T23:16:56Z",
    "severity": "LOW"
  },
  "details": "An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.",
  "id": "GHSA-6jp9-p482-x6c9",
  "modified": "2026-10-19T00:30:24Z",
  "published": "2026-10-19T00:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112112"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.nic.cz/labs/bird/-/blob/v2.20.0/nest/rt-table.c#L2686"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.nic.cz/labs/bird/-/blob/v3.4.0/nest/rt-table.c#L4518"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.nic.cz/labs/bird/-/commit/7cf75587b6f38b87849fe192bf5dfd124b7702bc"
    },
    {
      "type": "WEB",
      "url": "https://www.rfc-editor.org/rfc/rfc8956.html#section-5"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-112112 (GCVE-0-2026-112112)

Vulnerability from cvelistv5 – Published: 2026-10-18 23:01 – Updated: 2026-10-18 23:01

Summary

Severity

2.3 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2339 records in the last 180 days details

References

4 references

URL	Tags
https://gitlab.nic.cz/labs/bird/-/commit/7cf75587…	patch
https://www.rfc-editor.org/rfc/rfc8956.html#section-5
https://gitlab.nic.cz/labs/bird/-/blob/v2.20.0/ne…
https://gitlab.nic.cz/labs/bird/-/blob/v3.4.0/nes…

Impacted products

1 product

Vendor	Product	Version
nic	BIRD	Affected: 2.0.9 , ≤ 2.20.0 (semver) Affected: 3.0.0 , ≤ 3.4.0 (semver) cpe:2.3:a:nic:bird:::::::: cpe:2.3:a:nic:bird::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "IPv6 FlowSpec validation"
          ],
          "product": "BIRD",
          "programFiles": [
            "nest/rt-table.c"
          ],
          "programRoutines": [
            {
              "name": "net_flow_has_dst_prefix"
            }
          ],
          "repo": "https://gitlab.nic.cz/labs/bird",
          "vendor": "nic",
          "versions": [
            {
              "lessThanOrEqual": "2.20.0",
              "status": "affected",
              "version": "2.0.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "3.4.0",
              "status": "affected",
              "version": "3.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn established BGP peer must be able to send IPv6 FlowSpec to a receiving flow6 channel configured with \"validate yes\". A suitable unicast route from that peer must be present in the base table. Propagation additionally requires an export policy permitting the rule. Data-plane impact depends on downstream support for, acceptance of, and enforcement of the FlowSpec match and action.\u003c/p\u003e"
            }
          ],
          "value": "An established BGP peer must be able to send IPv6 FlowSpec to a receiving flow6 channel configured with \"validate yes\". A suitable unicast route from that peer must be present in the base table. Propagation additionally requires an export policy permitting the rule. Data-plane impact depends on downstream support for, acceptance of, and enforcement of the FlowSpec match and action."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:nic:bird:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.20.0",
                  "versionStartIncluding": "2.0.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:nic:bird:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "3.4.0",
                  "versionStartIncluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.3,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-18T23:01:05.633Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "patch"
          ],
          "url": "https://gitlab.nic.cz/labs/bird/-/commit/7cf75587b6f38b87849fe192bf5dfd124b7702bc"
        },
        {
          "url": "https://www.rfc-editor.org/rfc/rfc8956.html#section-5"
        },
        {
          "url": "https://gitlab.nic.cz/labs/bird/-/blob/v2.20.0/nest/rt-table.c#L2686"
        },
        {
          "url": "https://gitlab.nic.cz/labs/bird/-/blob/v3.4.0/nest/rt-table.c#L4518"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eApply upstream commit 7cf75587b6f38b87849fe192bf5dfd124b7702bc or a verified branch-specific backport. The fix requires the original IPv6 destination-prefix component to have offset zero before it can pass FlowSpec validation. The first fixed release has not yet been verified.\u003c/p\u003e"
            }
          ],
          "value": "Apply upstream commit 7cf75587b6f38b87849fe192bf5dfd124b7702bc or a verified branch-specific backport. The fix requires the original IPv6 destination-prefix component to have offset zero before it can pass FlowSpec validation. The first fixed release has not yet been verified."
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-112112",
    "datePublished": "2026-10-18T23:01:05.633Z",
    "dateReserved": "2026-10-18T23:01:05.103Z",
    "dateUpdated": "2026-10-18T23:01:05.633Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted