CVE-2026-112112: CWE-1284 Improper Validation of Specified Quantity in Input in nic BIRD

The vulnerability involves an IPv6 FlowSpec validation bypass in BIRD where the daemon incorrectly validates destination prefix components with nonzero offsets. Instead of rejecting such prefixes, BIRD reconstructs them with zero-filled skipped bits, allowing broader matching than intended. When validation is enabled on the receiving flow6 channel, this flaw permits an established BGP peer to inject FlowSpec rules that can pass validation if a suitable unicast route exists. These rules may then be propagated to downstream peers, potentially causing unauthorized traffic filtering or redirection.

An attacker with an established BGP session can inject FlowSpec rules that match IPv6 destinations outside the authorized address space. This can lead to unauthorized traffic filtering or redirection on downstream peers if export policies allow propagation. The impact is limited by the need for an established BGP peer relationship and suitable unicast routes. The CVSS score of 2.3 reflects a low severity with partial attack complexity and privileges required.

No official patch or fix is currently documented. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, operators should carefully review BGP peer relationships and export policies to limit the risk of unauthorized FlowSpec rule propagation. Consider disabling FlowSpec validation on the flow6 channel if feasible or applying strict filtering on received FlowSpec rules.