Read the docs
TI-2026-76212 Aliases CVE-2026-112112GHSA-6jp9-p482-x6c9

IPv6 FlowSpec validation bypass in BIRD lets BGP peers inject rules

Priority LOW 12CWE-1284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

CZ.NIC BIRD from 2.0.9 through 2.20.0 and from 3.0.0 through 3.4.0 mishandles IPv6 FlowSpec prefixes (CWE-1284). It fails to reject nonzero offsets and validates prefixes with zero-filled skipped bits, so rules can match broader addresses. An established BGP peer with a suitable unicast route can inject such a rule when flow6 validation is enabled. Where export policy permits, downstream peers may enforce it, causing unauthorized traffic filtering or redirection.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00308 23rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CZ.NICBIRD2.0.9 – 2.20.0; 3.0.0 – 3.4.0—No fix listedCNA
  • BIRD VendorCZ.NIC Affected 2.0.9 – 2.20.0; 3.0.0 – 3.4.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for BIRD.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-18 Threatist record created from CVE-2026-112112
  2. 2026-10-19 Alias added: GHSA-6jp9-p482-x6c9
  3. 2026-10-20 CISA SSVC decision points changed
  4. 2026-11-06 Affected versions changed · Red Hat
  5. 2026-11-06 CVSS score added · Red Hat

References

Patch 1

Other 3

  • TI-2023-27571 Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related… CVSS 3.1HIGH 7.5
  • TI-2026-47140 Knot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow… CVSS 3.1HIGH 8.1
  • TI-2021-08533 BIRD through 2.0.7 does not provide functionality for password authentication of BGP… CVSS 3.1MEDIUM 6.8
  • TI-2021-02344 Foris before 101.1.1, as used in Turris OS, lacks certain HTML escaping in the login template. CVSS 3.1CRITICAL 9.8
  • TI-2020-10072 Knot Resolver before 5.1.1 allows traffic amplification via a crafted DNS answer from an… CVSS 3.1HIGH 7.5
  • TI-2022-19055 Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU… CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences