IPv6 FlowSpec Validation Bypass in BIRD Internet Routing Daemon by CZ.NIC
CVE-2026-112112

2.3LOW

Key Information:

Vendor

Nic

Status
Bird
Vendor
CVE Published:
18 October 2026

What is CVE-2026-112112?

The IPv6 FlowSpec validation bypass in the BIRD Internet Routing Daemon allows an authorized BGP peer to inject FlowSpec rules that may match destinations beyond those permitted by the unicast-route validation. Despite having validation enabled, BIRD incorrectly accepts destination prefixes with nonzero offsets, as outlined in RFC 8956, allowing broader IPv6 address matching. This flaw could result in the propagation of unauthorized routing rules to downstream peers, potentially leading to traffic filtering or redirection that compromises network integrity.

Affected Version(s)

BIRD 2.0.9 <= 2.20.0

BIRD 3.0.0 <= 3.4.0

References

https://gitlab.nic.cz/labs/bird/-/commit/7cf75587b6f38b87...
patch
https://www.rfc-editor.org/rfc/rfc8956.html#section-5
https://gitlab.nic.cz/labs/bird/-/blob/v2.20.0/nest/rt-ta...

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.