Stack-based Buffer Overflow in BIRD Internet Routing Daemon by CZ.NIC

CVE-2026-49943

What is CVE-2026-49943?

The BIRD Internet Routing Daemon experiences a stack-based buffer overflow due to improper handling of BGP AS_PATH segments. Specifically, in the as_path_match() function, the daemon allocates a fixed-size stack array, while allowing for the expansion of AS_PATH segments without a corresponding capacity limit. This flaw can be exploited when BGP Extended Messages are enabled, permitting an established BGP peer to send an excessive number of ASNs, which exceeds the stack buffer size. As a result, an attacker can trigger a crash in the daemon, impacting network stability. Users are advised to implement filtering to reject routes with unusually long attributes.

References