{"id":"CVE-2026-49943","aliases":["DEBIAN-CVE-2026-49943","EUVD-2026-33980","GHSA-64c8-8qx9-25r7","UBUNTU-CVE-2026-49943"],"status":"published","title":"CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the...","description":"CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.003,"percentile":0.23077,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-121"],"published":"2026-06-02T16:16:52Z","modified":"2026-10-28T02:31:10Z","exploits":[{"source":"pocgithub","id":"cxwx/CVE-2026-49943-PoC","title":"cxwx/CVE-2026-49943-PoC","date":"2026-06-03","url":"https://github.com/cxwx/CVE-2026-49943-PoC"}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"bird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.8-2.1"]},{"source":"osv","ecosystem":"Debian:12","package":"bird2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.12-7","2.14-1","2.15-1","2.15.1-1","2.15.1-1.1","2.16-1","2.16.1-1","2.17-1","2.17.1-1","2.17.2-1","2.17.3-1","2.17.3-2","2.18-1","2.18.1-1","2.19.0-1","2.19.1-1","2.19.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"bird2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17.1-1","2.17.1-1+deb13u1","2.17.1-1+deb13u2","2.17.2-1","2.17.3-1","2.17.3-2","2.17.5-0+deb13u1","2.18-1","2.18.1-1","2.19.0-1","2.19.1-1","2.19.2-1"]},{"source":"osv","ecosystem":"Debian:14","package":"bird2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17.1-1","2.17.2-1","2.17.3-1","2.17.3-2","2.18-1","2.18.1-1","2.19.0-1","2.19.1-1","2.19.2-1"]},{"source":"osv","ecosystem":"Debian:13","package":"bird3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0-1","3.1.4-1","3.1.5-1","3.1.5-2","3.1.7-0+deb13u1","3.2.0-1","3.2.1-1","3.3.0-1","3.3.0-1~bpo13+1","3.3.1-1","3.3.2-1","3.3.2-1~bpo13+1"]},{"source":"osv","ecosystem":"Debian:14","package":"bird3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0-1","3.1.4-1","3.1.5-1","3.1.5-2","3.2.0-1","3.2.1-1","3.3.0-1","3.3.0-1~bpo13+1","3.3.1-1","3.3.2-1","3.3.2-1~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"bird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.0-4","1.5.0-4build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"bird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.3-3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.7-1","1.6.8-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"bird2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.5-1","2.0.7-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.8-2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bird2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.7-4.1","2.0.8-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bird","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.8-2.1","1.6.8-2.1build1","1.6.8-2.1build2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bird2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.12-7","2.14-1","2.14-1build1","2.14-1build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"bird2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.1-1","2.17-1","2.17.1-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"bird3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"bird2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.18-1","2.18.1-1","2.19.0-1","2.19.1-1","2.19.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"bird3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.0-1","3.2.1-1","3.3.0-1","3.3.1-1","3.3.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bird2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17.1-1","2.17.2-1","2.17.3-1","2.17.3-2","2.18-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bird3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.0-1","3.1.4-1","3.1.5-1","3.1.5-2","3.2.0-1"]}],"products":[{"vendor":"nic","product":"bird"}],"references":[{"url":"https://bird.nic.cz","tags":["web"]},{"url":"https://gitlab.nic.cz/labs/bird/-/blob/master/NEWS","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49943","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-64c8-8qx9-25r7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49943.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-49943","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-49943","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49943","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/06/02/2","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-49943","description":"CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.","status":"published","published":"2026-06-02T16:16:52.033Z","modified":"2026-06-02T18:24:47.786Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T13:34:59.78118Z"}],"euvd":[{"id":"EUVD-2026-33980","description":"CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.","status":"published","published":"2026-06-02T16:16:52Z","modified":"2026-06-02T18:24:47Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:55.651138Z"}],"ghsa":[{"id":"GHSA-64c8-8qx9-25r7","title":"CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the...","description":"CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.","status":"published","published":"2026-06-02T18:31:34Z","modified":"2026-06-02T18:31:43Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:08:30.158602Z"}],"nvd":[{"id":"CVE-2026-49943","description":"CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.","status":"published","published":"2026-06-02T17:16:37.657Z","modified":"2026-07-22T19:10:00.12Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:12:22.022466Z"}],"osv":[{"id":"CVE-2026-49943","description":"CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.","status":"published","published":"2026-06-02T16:16:52.033Z","modified":"2026-10-28T02:31:10.858317935Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:45:07.060148Z"},{"id":"DEBIAN-CVE-2026-49943","description":"CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.","status":"published","published":"2026-06-02T17:16:37.657Z","modified":"2026-10-01T03:02:42.68956505Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:56.444225Z"},{"id":"UBUNTU-CVE-2026-49943","description":"CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as \"bgp_path ~ [= ... =]\", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.","status":"published","published":"2026-06-02T17:16:00Z","modified":"2026-10-17T12:58:32.647579395Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:33.391918Z"}]}}