CVE-2026-112112

Received Received - Intake

IPv6 FlowSpec Validation Bypass in BIRD Internet Routing Daemon

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: MITRE

Description

An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-112112

EUVD

EUVD-2026-104014

Affected Vendors & Products

Vendor	Product	Version / Range
nic	BIRD	2.0.9
nic	BIRD	3.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1284	The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.

Attack-Flow Graph

Executive Summary

This vulnerability is an IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon. It allows an established BGP peer to inject FlowSpec rules that match destinations outside the address space authorized by unicast-route validation. BIRD fails to reject a destination prefix component with a nonzero offset, violating RFC 8956 section 5. The issue arises because BIRD validates a reconstructed prefix with zero-filled skipped bits, even though the original FlowSpec component can match a broader set of IPv6 addresses.

Detection Guidance

Detecting this vulnerability requires checking BIRD's configuration and logs for improper FlowSpec validation. Inspect BIRD's configuration for flow6 channel settings and validate if destination prefix components with nonzero offsets are being accepted. Check logs for FlowSpec rule propagation from BGP peers. Ensure unicast-route validation is enabled and correctly implemented per RFC 8956.

Impact Analysis

If you use BIRD with IPv6 FlowSpec and validation enabled, an attacker who is a BGP peer could exploit this to inject unauthorized FlowSpec rules. This may cause unauthorized traffic filtering or redirection on your network. If export policies permit, these rules could propagate to downstream peers, affecting their traffic as well.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to network routing and BGP FlowSpec validation. The issue involves unauthorized traffic filtering or redirection due to improper IPv6 FlowSpec validation, which is unrelated to data protection standards like GDPR or HIPAA.

Mitigation Strategies

Disable FlowSpec support on BIRD if not required or apply patches from CZ.NIC. Review BGP peer export policies to prevent unauthorized FlowSpec propagation. Monitor BGP sessions for unexpected prefix components.

Hi! I’m here to help you understand CVE-2026-112112. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70