Denial of Service Vulnerability in BIRD Looking Glass by xddxdd
CVE-2026-45047

7.5HIGH

Key Information:

Vendor

Xddxdd

Status
Bird-lg-go
Vendor
CVE Published:
27 May 2026

What is CVE-2026-45047?

The BIRD looking glass tool, bird-lg-go, prior to version 1.4.5, is vulnerable to a denial of service attack due to improper handling of user-provided JSON payloads. Specifically, the apiHandler and webHandlerTelegramBot lack restrictions on the maximum read size when processing input, allowing attackers to send excessively large JSON streams. This can lead to significant memory consumption, potentially exhausting system RAM and resulting in a fatal runtime error. An update to version 1.4.5 addresses this issue by implementing necessary limitations on read sizes.

Affected Version(s)

bird-lg-go < 1.4.5

References

https://github.com/xddxdd/bird-lg-go/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.