CVE-2026-45047: xddxdd bird-lg-go denial of service in apiHandler

Executive brief

A vulnerability in the bird-lg-go tool allows an unauthenticated attacker to crash the service remotely. By sending a specially crafted, oversized data request, an attacker can force the application to consume all available system memory. This results in the operating system terminating the process, leading to a complete service outage.

Technical details

The bird-lg-go daemon's apiHandler and webHandlerTelegramBot components fail to restrict the maximum size of incoming HTTP request bodies. Specifically, the application uses json.NewDecoder(r.Body).Decode(&request) without an accompanying http.MaxBytesReader. An unauthenticated remote attacker can stream an arbitrarily large JSON payload, causing the Go runtime to attempt massive memory allocations. This triggers a fatal out-of-memory (OOM) error, leading the Linux OOM Killer to terminate the daemon. The issue is addressed in version 0.0.0-20260507060110-0ff87024cb9e (and later releases like v1.4.5) by implementing request size limits.

Affected products

• xddxdd bird-lg-go < 0.0.0-20260507060110-0ff87024cb9e

Timeline

• 2026-05-07: patched: Fix committed to repository
• 2026-05-11: advisory: GitHub Advisory published

References

• https://api.github.com/users/9Bakabaka
• https://github.com/9Bakabaka
• https://api.github.com/users/9Bakabaka/gists%7B/gist_id%7D
• https://api.github.com/users/9Bakabaka/repos
• https://avatars.githubusercontent.com/u/140469824?v=4
• https://api.github.com/users/9Bakabaka/events%7B/privacy%7D