CVE-2026-45047

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-45047", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-08T18:07:27.341Z", "datePublished": "2026-05-27T16:37:36.191Z", "dateUpdated": "2026-05-27T18:03:10.363Z"}, "containers": {"cna": {"title": "bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding", "problemTypes": [{"descriptions": [{"cweId": "CWE-400", "lang": "en", "description": "CWE-400: Uncontrolled Resource Consumption", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm"}], "affected": [{"vendor": "xddxdd", "product": "bird-lg-go", "versions": [{"version": "< 1.4.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T16:37:36.191Z"}, "descriptions": [{"lang": "en", "value": "bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(&request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5."}], "source": {"advisory": "GHSA-39qr-rc93-vhqm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-27T18:03:03.834690Z", "id": "CVE-2026-45047", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T18:03:10.363Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-45047", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-27T18:03:03.834690Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-27T18:03:07.174Z"}}], "cna": {"title": "bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding", "source": {"advisory": "GHSA-39qr-rc93-vhqm", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "xddxdd", "product": "bird-lg-go", "versions": [{"status": "affected", "version": "< 1.4.5"}]}], "references": [{"url": "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm", "name": "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(&request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400: Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-27T16:37:36.191Z"}}}, "cveMetadata": {"cveId": "CVE-2026-45047", "state": "PUBLISHED", "dateUpdated": "2026-05-27T18:03:10.363Z", "dateReserved": "2026-05-08T18:07:27.341Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-27T16:37:36.191Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "bird-lg-go", "vendor": "xddxdd", "versions": [{"status": "affected", "version": "< 1.4.5"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(&request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5."}, {"lang": "es", "value": "bird-lg-go es un looking glass BIRD en Go. Antes de la versi\u00f3n 1.4.5, el apiHandler (y de manera similar webHandlerTelegramBot) procesa las cargas \u00fatiles JSON proporcionadas por el usuario utilizando directamente json.NewDecoder(r.Body).Decode(&request) sin restringir el tama\u00f1o m\u00e1ximo de lectura. Un atacante remoto no autenticado puede transmitir una carga \u00fatil JSON extremadamente grande e interminable (por ejemplo, varios Gigabytes de relleno) a trav\u00e9s de una \u00fanica conexi\u00f3n TCP. Debido a que el decodificador JSON de Go intenta asignar memoria para toda la estructura analizada, esto agota r\u00e1pidamente la RAM f\u00edsica del host o los l\u00edmites del contenedor, lo que lleva a un error fatal irrecuperable: runtime: out of memory. Esta vulnerabilidad se corrige en la versi\u00f3n 1.4.5."}], "id": "CVE-2026-45047", "lastModified": "2026-10-26T11:10:00.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45047", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-27T18:03:03.834690Z", "version": "2.0.3"}}]}, "published": "2026-05-27T18:16:24.150", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "bird-lg-go", "source": "cna", "vendor": "xddxdd"}, "product": "bird-lg-go", "vendor": "xddxdd"}], "created": "2026-05-27T19:30:35.584374+00:00", "updated": "2026-05-28T05:00:08.307675+00:00", "vendors": ["xddxdd", "xddxdd$PRODUCT$bird-lg-go"]}