CVE catalog

CVE-2026-112112

An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the

[CVE catalog]

Severity: Low · CVSS 2.3CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Oct 18, 2026, 11:16:56 PM UTC
Updated: Oct 18, 2026, 11:16:56 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.31% · Oct 25, 2026

An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	bird2	sid	`2.20.0-1`	vulnerable
Debian	bird2	forky	`2.20.0-1`	vulnerable
Debian	bird2	trixie	`2.17.5-0+deb13u1`	vulnerable
Debian	bird2	trixie-security	`2.17.5-0+deb13u1`	vulnerable
Debian	bird2	bookworm	`2.0.12-7`	vulnerable
Ubuntu	bird2	20.04	`2.0.5-1`	vulnerable
Ubuntu	bird2	20.04	`2.0.7-2`	vulnerable
Ubuntu	bird2	22.04	`2.0.7-4.1`	vulnerable
Ubuntu	bird2	22.04	`2.0.8-2`	vulnerable
Ubuntu	bird2	24.04	`2.0.12-7`	vulnerable
Ubuntu	bird2	24.04	`2.14-1`	vulnerable
Ubuntu	bird2	24.04	`2.14-1build1`	vulnerable
Ubuntu	bird2	24.04	`2.14-1build2`	vulnerable
Ubuntu	bird2	26.10	`2.18-1`	vulnerable
Ubuntu	bird2	26.10	`2.18.1-1`	vulnerable
Ubuntu	bird2	26.10	`2.19.0-1`	vulnerable
Ubuntu	bird2	26.10	`2.19.1-1`	vulnerable
Ubuntu	bird2	26.10	`2.19.2-1`	vulnerable
Ubuntu	bird3	26.10	`3.2.0-1`	vulnerable
Ubuntu	bird3	26.10	`3.2.1-1`	vulnerable
Ubuntu	bird3	26.10	`3.3.0-1`	vulnerable
Ubuntu	bird3	26.10	`3.3.1-1`	vulnerable
Ubuntu	bird3	26.10	`3.3.2-1`	vulnerable
Ubuntu	bird2	26.04	`2.17.1-1`	vulnerable
Ubuntu	bird2	26.04	`2.17.2-1`	vulnerable
Ubuntu	bird2	26.04	`2.17.3-1`	vulnerable
Ubuntu	bird2	26.04	`2.17.3-2`	vulnerable
Ubuntu	bird2	26.04	`2.18-1`	vulnerable
Ubuntu	bird3	26.04	`3.1.0-1`	vulnerable
Ubuntu	bird3	26.04	`3.1.4-1`	vulnerable
Ubuntu	bird3	26.04	`3.1.5-1`	vulnerable
Ubuntu	bird3	26.04	`3.1.5-2`	vulnerable
Ubuntu	bird3	26.04	`3.2.0-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	bird2	source	sid	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	bird2	source	forky	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	bird2	source	trixie	`(unfixed)`	not yet assigned	Not reported	Not reported
Debian	bird2	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

Notes

[trixie] bird2: Minor issue [bookworm] bird2: Minor issue; can be fixed in next update

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[bird2]Affected
Details (2)
- 2.0.12-7 · amd64 · bookworm
  Affected
  nvd · bird2 · debian · bookworm; nvd · bird2 · debian · 12
- 2.0.12-7 · arm64 · bookworm
  Affected
  nvd · bird2 · debian · bookworm; nvd · bird2 · debian · 12
[bird2-doc]Affected
Source package: [bird2]
Details (2)
- 2.0.12-7 · all · bookworm
  Affected
  nvd · bird2 · debian · bookworm; nvd · bird2 · debian · 12
- 2.0.12-7 · all · bookworm
  Affected
  nvd · bird2 · debian · bookworm; nvd · bird2 · debian · 12

[Debian 13 (Trixie)]

[bird2]Affected
Details (4)
- 2.17.5-0+deb13u1 · amd64 · trixie
  Affected
  nvd · bird2 · debian · 13
- 2.17.5-0+deb13u1 · arm64 · trixie
  Affected
  nvd · bird2 · debian · 13
- 2.17.5-0+deb13u1 · amd64 · trixie-security
  Affected
  nvd · bird2 · debian · 13
- 2.17.5-0+deb13u1 · arm64 · trixie-security
  Affected
  nvd · bird2 · debian · 13
[bird2-doc]Affected
Source package: [bird2]
Details (4)
- 2.17.5-0+deb13u1 · all · trixie
  Affected
  nvd · bird2 · debian · 13
- 2.17.5-0+deb13u1 · all · trixie
  Affected
  nvd · bird2 · debian · 13
- 2.17.5-0+deb13u1 · all · trixie-security
  Affected
  nvd · bird2 · debian · 13
- 2.17.5-0+deb13u1 · all · trixie-security
  Affected
  nvd · bird2 · debian · 13
[bird3]Affected
Details (6)
- 3.1.7-0+deb13u1 · amd64 · trixie
  Affected
  nvd · bird3 · debian · 13
- 3.1.7-0+deb13u1 · arm64 · trixie
  Affected
  nvd · bird3 · debian · 13
- 3.3.2-1~bpo13+1 · amd64 · trixie-backports
  Affected
  nvd · bird3 · debian · 13
- 3.3.2-1~bpo13+1 · arm64 · trixie-backports
  Affected
  nvd · bird3 · debian · 13
- 3.1.7-0+deb13u1 · amd64 · trixie-security
  Affected
  nvd · bird3 · debian · 13
- 3.1.7-0+deb13u1 · arm64 · trixie-security
  Affected
  nvd · bird3 · debian · 13
[bird3-doc]Affected
Source package: [bird3]
Details (6)
- 3.1.7-0+deb13u1 · all · trixie
  Affected
  nvd · bird3 · debian · 13
- 3.1.7-0+deb13u1 · all · trixie
  Affected
  nvd · bird3 · debian · 13
- 3.3.2-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · bird3 · debian · 13
- 3.3.2-1~bpo13+1 · all · trixie-backports
  Affected
  nvd · bird3 · debian · 13
- 3.1.7-0+deb13u1 · all · trixie-security
  Affected
  nvd · bird3 · debian · 13
- 3.1.7-0+deb13u1 · all · trixie-security
  Affected
  nvd · bird3 · debian · 13

Observed: Oct 27, 2026, 4:09:06 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]