{"id":"GHSA-39qr-rc93-vhqm","revision":"ccd97bc1bef64128a051ac0af3244593","records":[{"revision":"ccd97bc1bef64128a051ac0af3244593","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-39qr-rc93-vhqm","aliases":["CVE-2026-45047","GO-2026-5077"],"title":"Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding","description":"### Summary\nThe `apiHandler` (and similarly `webHandlerTelegramBot`) processes user-provided JSON payloads by directly using `json.NewDecoder(r.Body).Decode(&request)` without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable `fatal error: runtime: out of memory`. \n\nThis causes the Linux OOM Killer to instantly terminate the entire `bird-lg-go` daemon, resulting in a severe Remote Denial of Service (RDoS).\n\n### Details\nIn `api.go`:\n```go\nfunc apiHandler(w http.ResponseWriter, r *http.Request) {\n    var request apiRequest\n    // VULNERABILITY: No http.MaxBytesReader protection before JSON decode\n    err := json.NewDecoder(r.Body).Decode(&request) \n    // ...","state":0,"publishedAt":"2026-05-11T16:17:48+00:00","modifiedAt":"2026-06-25T18:56:27.8767883+00:00","affected":[{"ecosystem":"Go","name":"github.com/xddxdd/bird-lg-go","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260507060110-0ff87024cb9e"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm","https://nvd.nist.gov/vuln/detail/CVE-2026-45047","https://github.com/xddxdd/bird-lg-go/commit/0ff87024cb9ed01fc5f5fdc6f4603fce4c123922","https://github.com/xddxdd/bird-lg-go","https://github.com/xddxdd/bird-lg-go/releases/tag/v1.4.5"],"sourceUrl":"https://github.com/advisories/GHSA-39qr-rc93-vhqm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-39qr-rc93-vhqm","identifiers":["GHSA-39qr-rc93-vhqm","CVE-2026-45047","GO-2026-5077"]},"retained":false,"historicalAffected":[]}],"coverage":[]}