CVE-2026-49943
Description
A flaw was found in the BIRD Internet Routing Daemon. An established BGP (Border Gateway Protocol) peer can send a specially crafted BGP UPDATE message containing an unusually long AS_PATH (Autonomous System Path) attribute. When a BIRD filter evaluates an AS path mask expression, this can lead to a stack-based buffer overflow in the as_path_match() function. This vulnerability can cause the daemon to crash, resulting in a Denial of Service (DoS).
Statement
Red Hat ships the BIRD Internet Routing Daemon as part of the netshoot container in Ansible Services on Clouds. This vulnerability requires multiple preconditions for exploitation: RFC 8654 BGP Extended Messages must be enabled, BIRD must be configured with a filter that evaluates AS path mask expressions, and the attacker must be an established BGP peer. The upstream vendor has not prioritized a fix.
Mitigation
Configure BIRD filters to reject BGP routes with unusually long AS_PATH attributes before evaluating AS path mask expressions. Additionally, disable RFC 8654 BGP Extended Messages if not required, or limit BGP peering to trusted peers only.
Understanding the Weakness (CWE)
Integrity,Confidentiality,Availability
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of the product's implicit security policy. This can often be used to subvert any other security service.
Availability
Technical Impact: Modify Memory; DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the product into an infinite loop.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
