{"id":"CVE-2026-112112","revision":"5586c1642e6e425880adf757fa098109","records":[{"revision":"5586c1642e6e425880adf757fa098109","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-112112","aliases":[],"title":"An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With…","description":"An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.","state":0,"publishedAt":"2026-10-18T23:01:05.633+00:00","modifiedAt":"2026-10-19T18:41:47.949+00:00","affected":[{"ecosystem":"Vendor product","name":"BIRD","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unknown\",\n                    \"modules\": [\n                        \"IPv6 FlowSpec validation\"\n                    ],\n                    \"product\": \"BIRD\",\n                    \"programFiles\": [\n                        \"nest/rt-table.c\"\n                    ],\n                    \"programRoutines\": [\n                        {\n                            \"name\": \"net_flow_has_dst_prefix\"\n                        }\n                    ],\n                    \"repo\": \"https://gitlab.nic.cz/labs/bird\",\n                    \"vendor\": \"nic\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"2.20.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"2.0.9\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"3.4.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"3.0.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.3,"severity":"LOW"}],"references":["https://gitlab.nic.cz/labs/bird/-/commit/7cf75587b6f38b87849fe192bf5dfd124b7702bc","https://www.rfc-editor.org/rfc/rfc8956.html#section-5","https://gitlab.nic.cz/labs/bird/-/blob/v2.20.0/nest/rt-table.c#L2686","https://gitlab.nic.cz/labs/bird/-/blob/v3.4.0/nest/rt-table.c#L4518"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112112","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-112112","identifiers":["CVE-2026-112112"]},"retained":false,"historicalAffected":[]}],"coverage":[]}