CVE-2026-112112
Description
A flaw was found in BIRD. An established Border Gateway Protocol (BGP) peer can bypass route validation by injecting crafted IPv6 Flow Specification (FlowSpec) rules containing destination prefixes with non-zero offsets. Because BIRD improperly validates these reconstructed prefixes against authorized unicast routes, it fails to reject rules matching destination addresses outside the peer's permitted scope. If accepted and propagated downstream, these rules can result in unauthorized network traffic redirection or traffic filtering.
Statement
This vulnerability is rated as having Moderate severity for Red Hat because successful exploitation requires an established BGP peering session, preventing unauthenticated remote attackers from triggering the condition. The flaw only manifests when the receiving flow6 channel has route validation explicitly enabled. Additionally, BIRD is not shipped in core Red Hat Enterprise Linux releases and is only available through community repositories such as EPEL.
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context; Bypass Protection Mechanism
Attackers can sometimes bypass input validation schemes by finding inputs that appear to be safe, but will be dangerous when processed at a lower layer or by a downstream component. For example, a simple XSS protection mechanism might try to validate that an input has no "<script>" tags using case-sensitive matching (CWE-178), but since HTML is case-insensitive when processed by web browsers, an attacker could inject "<ScrIpT>" and trigger XSS (CWE-79).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
