{"id":"EUVD-2026-32583","enisaUuid":"974354ab-388b-37d0-ac95-56ff0cc12421","description":"bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(\u0026request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go\u0027s JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host\u0027s physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5.","datePublished":"May 27, 2026, 4:37:36 PM","dateUpdated":"May 27, 2026, 6:03:10 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm\n","aliases":"CVE-2026-45047\nGHSA-39qr-rc93-vhqm\n","assigner":"GitHub_M","epss":0.44,"enisaIdProduct":[{"id":"dc091483-2ba9-37e8-aa22-bbbd35d3b1d1","product":{"name":"bird-lg-go","vendor":{"name":"xddxdd"}},"product_version":"\u003c 1.4.5"}],"enisaIdVendor":[{"id":"470efdeb-36b2-3837-be86-4bd7dd7b719f","vendor":{"name":"xddxdd"}}],"enisaIdVulnerability":[{"id":"bbd23098-ec83-3350-a674-8e4809e4a554","vulnerability":{"id":"CVE-2026-45047","description":"bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(\u0026request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go\u0027s JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host\u0027s physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5.","datePublished":"May 27, 2026, 4:37:36 PM","dateUpdated":"May 27, 2026, 6:03:10 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm\n","enisa_id":"EUVD-2026-32583\n","assigner":"GitHub_M","epss":0.44,"dataProcessed":"Nov 1, 2026, 7:18:17 AM","vulnerabilityProduct":[{"id":"a6d1c30b-5a43-3a24-9956-8e646b142601","product":{"name":"bird-lg-go","vendor":{"name":"xddxdd"}},"product_version":"\u003c 1.4.5"}],"vulnerabilityVendor":[{"id":"3a0ccd34-b07d-3263-b2e9-59c36a714ad9","vendor":{"name":"xddxdd"}}]}},{"id":"fd7bb7e5-485b-364f-8d5e-cdc523f9db13","vulnerability":{"id":"GHSA-39qr-rc93-vhqm","description":"Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding","datePublished":"May 11, 2026, 4:17:48 PM","dateUpdated":"Jun 8, 2026, 11:49:47 PM","baseScore":0.0,"references":"https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45047\nhttps://github.com/xddxdd/bird-lg-go/commit/0ff87024cb9ed01fc5f5fdc6f4603fce4c123922\nhttps://github.com/xddxdd/bird-lg-go\nhttps://github.com/xddxdd/bird-lg-go/releases/tag/v1.4.5\n","enisa_id":"EUVD-2026-32583\n","aliases":"CVE-2026-45047\nGHSA-39qr-rc93-vhqm\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}