FKIE_CVE-2026-49943

Vulnerability from fkie_nvd - Published: 2026-06-02 17:16 - Updated: 2026-07-22 19:10
Severity
6.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Summary
CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as "bgp_path ~ [= ... =]", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.
References
cve@mitre.orghttps://bird.nic.cz
cve@mitre.orghttps://gitlab.nic.cz/labs/bird/-/blob/master/NEWS
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "BIRD",
          "vendor": "NIC",
          "versions": [
            {
              "lessThanOrEqual": "2.19.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier\u0027s position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes."
    },
    {
      "lang": "es",
      "value": "CZ.NIC BIRD Internet Routing Daemon hasta la versi\u00f3n 2.19.0 contiene un desbordamiento de b\u00fafer basado en pila en la implementaci\u00f3n de coincidencia de m\u00e1scara BGP AS_PATH en nest/a-path.c. La funci\u00f3n as_path_match() utiliza un array de pila de tama\u00f1o fijo de 2048 + 1 entradas pm_pos, mientras que parse_path() expande segmentos AS_PATH de una ACTUALIZACI\u00d3N BGP recibida sin aplicar un l\u00edmite de capacidad correspondiente. Cuando los Mensajes Extendidos BGP RFC 8654 est\u00e1n habilitados y un filtro BIRD eval\u00faa una expresi\u00f3n de m\u00e1scara de ruta AS como \u0027bgp_path ~ [= ... =]\u0027, un par BGP establecido puede enviar una AS_PATH larga que contenga m\u00e1s de 2048 ASNs expandidos. Esto provoca que parse_path()/as_path_match() escriba m\u00e1s all\u00e1 del b\u00fafer de pila fijo, lo que resulta en un fallo del demonio. NOTA: seg\u00fan se informa, la posici\u00f3n del Proveedor es que una soluci\u00f3n no est\u00e1 siendo priorizada porque todos los operadores de red ya deber\u00edan estar rechazando rutas con atributos inusualmente largos."
    }
  ],
  "id": "CVE-2026-49943",
  "lastModified": "2026-07-22T19:10:00.120",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.0,
        "source": "cve@mitre.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49943",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-02T18:20:11.710969Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-02T17:16:37.657",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://bird.nic.cz"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://gitlab.nic.cz/labs/bird/-/blob/master/NEWS"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.