Executive brief
CZ.NIC BIRD is a routing daemon used by Internet Exchange Points (IXPs) and data centers to manage global internet traffic. A vulnerability in how it processes routing path information allows a connected peer to send a specially crafted message that crashes the service. This results in a denial-of-service condition that can disrupt network routing and connectivity.
Technical details
A stack-based buffer overflow exists in the as_path_match() function within nest/a-path.c of the BIRD Internet Routing Daemon. The function utilizes a fixed-size stack array of 2048 entries for path matching, but the parse_path() function fails to enforce capacity limits when expanding AS_PATH segments from BGP UPDATE messages. When RFC 8654 BGP Extended Messages are enabled and a filter evaluates an AS path mask expression, an authenticated BGP peer can send a path containing more than 2048 expanded ASNs. This results in an out-of-bounds write on the stack and a daemon crash. The vendor has reportedly not prioritized a fix, suggesting that operators should filter unusually long attributes at the network edge.
Affected products
- CZ.NIC BIRD Internet Routing Daemon through 2.19.0
Timeline
- 2026-06-02: advisory: CVE-2026-49943 published by MITRE/NVD