CVE-2026-112112
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.
CVE-2026-112112
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-112112
BIRD
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://gitlab.nic.cz/labs/bird",
"vendor": "nic",
"modules": [
"IPv6 FlowSpec validation"
],
"product": "BIRD",
"versions": [
{
"status": "affected",
"version": "2.0.9",
"versionType": "semver",
"lessThanOrEqual": "2.20.0"
},
{
"status": "affected",
"version": "3.0.0",
"versionType": "semver",
"lessThanOrEqual": "3.4.0"
}
],
"programFiles": [
"nest/rt-table.c"
],
"defaultStatus": "unknown",
"programRoutines": [
{
"name": "net_flow_has_dst_prefix"
}
]
}
]- Related CVEs
- CVE-2026-112112
Source reference:
/cveMetadata/cveId
Publisher severity
low
Source reference: /containers/cna/metrics
- Event
- #39805 · Revision 1
- Added to Heist Feed
- Publisher date