CVE-2026-49943

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-49943", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2026-06-02T16:16:51.394Z", "datePublished": "2026-06-02T16:16:52.033Z", "dateUpdated": "2026-06-02T18:24:47.786Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "BIRD", "vendor": "NIC", "versions": [{"lessThanOrEqual": "2.19.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:nic:bird:*:*:*:*:*:*:*:*", "versionEndIncluding": "2.19.0"}]}]}], "descriptions": [{"lang": "en", "value": "CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-06-02T16:19:03.910Z"}, "references": [{"url": "https://bird.nic.cz"}, {"url": "https://gitlab.nic.cz/labs/bird/-/blob/master/NEWS"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-02T18:20:11.710969Z", "id": "CVE-2026-49943", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T18:24:47.786Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-49943", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T18:20:11.710969Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T18:20:18.488Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "NIC", "product": "BIRD", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.19.0"}], "defaultStatus": "unknown"}], "references": [{"url": "https://bird.nic.cz"}, {"url": "https://gitlab.nic.cz/labs/bird/-/blob/master/NEWS"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nic:bird:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "2.19.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-06-02T16:19:03.910Z"}}}, "cveMetadata": {"cveId": "CVE-2026-49943", "state": "PUBLISHED", "dateUpdated": "2026-06-02T18:24:47.786Z", "dateReserved": "2026-06-02T16:16:51.394Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-06-02T16:16:52.033Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "BIRD", "vendor": "NIC", "versions": [{"lessThanOrEqual": "2.19.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes."}, {"lang": "es", "value": "CZ.NIC BIRD Internet Routing Daemon hasta la versi\u00f3n 2.19.0 contiene un desbordamiento de b\u00fafer basado en pila en la implementaci\u00f3n de coincidencia de m\u00e1scara BGP AS_PATH en nest/a-path.c. La funci\u00f3n as_path_match() utiliza un array de pila de tama\u00f1o fijo de 2048 + 1 entradas pm_pos, mientras que parse_path() expande segmentos AS_PATH de una ACTUALIZACI\u00d3N BGP recibida sin aplicar un l\u00edmite de capacidad correspondiente. Cuando los Mensajes Extendidos BGP RFC 8654 est\u00e1n habilitados y un filtro BIRD eval\u00faa una expresi\u00f3n de m\u00e1scara de ruta AS como 'bgp_path ~ [= ... =]', un par BGP establecido puede enviar una AS_PATH larga que contenga m\u00e1s de 2048 ASNs expandidos. Esto provoca que parse_path()/as_path_match() escriba m\u00e1s all\u00e1 del b\u00fafer de pila fijo, lo que resulta en un fallo del demonio. NOTA: seg\u00fan se informa, la posici\u00f3n del Proveedor es que una soluci\u00f3n no est\u00e1 siendo priorizada porque todos los operadores de red ya deber\u00edan estar rechazando rutas con atributos inusualmente largos."}], "id": "CVE-2026-49943", "lastModified": "2026-07-22T19:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 4.0, "source": "cve@mitre.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-49943", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-02T18:20:11.710969Z", "version": "2.0.3"}}]}, "published": "2026-06-02T17:16:37.657", "references": [{"source": "cve@mitre.org", "url": "https://bird.nic.cz"}, {"source": "cve@mitre.org", "url": "https://gitlab.nic.cz/labs/bird/-/blob/master/NEWS"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}], "source": "cve@mitre.org", "type": "Secondary"}]}

{"bugzilla": {"description": "bird: BIRD Internet Routing Daemon: Denial of Service via stack-based buffer overflow in BGP AS_PATH processing", "id": "2484046", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2484046"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.", "A flaw was found in the BIRD Internet Routing Daemon. An established BGP (Border Gateway Protocol) peer can send a specially crafted BGP UPDATE message containing an unusually long AS_PATH (Autonomous System Path) attribute. When a BIRD filter evaluates an AS path mask expression, this can lead to a stack-based buffer overflow in the `as_path_match()` function. This vulnerability can cause the daemon to crash, resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Configure BIRD filters to reject BGP routes with unusually long AS_PATH attributes before evaluating AS path mask expressions. Additionally, disable RFC 8654 BGP Extended Messages if not required, or limit BGP peering to trusted peers only."}, "name": "CVE-2026-49943", "public_date": "2026-06-02T16:16:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-49943\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-49943\nhttps://bird.nic.cz\nhttps://gitlab.nic.cz/labs/bird/-/blob/master/NEWS"], "statement": "Red Hat ships the BIRD Internet Routing Daemon as part of the netshoot container in Ansible Services on Clouds. This vulnerability requires multiple preconditions for exploitation: RFC 8654 BGP Extended Messages must be enabled, BIRD must be configured with a filter that evaluates AS path mask expressions, and the attacker must be an established BGP peer. The upstream vendor has not prioritized a fix.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.19.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "inferred", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "BIRD", "source": "cna", "vendor": "NIC"}, "product": "bird", "vendor": "nic"}], "created": "2026-06-02T18:30:14.760018+00:00", "updated": "2026-06-26T02:15:15.787782+00:00", "vendors": ["nic", "nic$PRODUCT$bird"]}