The vulnerability exists in the as_path_match() function of BIRD's BGP implementation, which uses a fixed-size stack array of 2049 entries to match AS_PATH masks. The parse_path() function expands AS_PATH segments from received BGP UPDATE messages without enforcing a limit on the number of ASNs. When RFC 8654 BGP Extended Messages are enabled and a filter evaluates an AS path mask expression, a malicious or misconfigured BGP peer can send an AS_PATH attribute exceeding 2048 ASNs, causing parse_path() and as_path_match() to write beyond the fixed stack buffer. This leads to a stack-based buffer overflow and daemon crash, resulting in denial of service. The vendor's position is that network operators should already filter out such unusually long routes, and no official fix or patch is currently provided.

Successful exploitation causes a denial of service by crashing the BIRD routing daemon. There is no indication of confidentiality or integrity impact. The CVSS score is 6.3 (medium severity) reflecting network attack vector, low privileges required, no user interaction, and impact limited to availability. No known exploits in the wild have been reported.

No official patch or fix is currently available or prioritized by the vendor. The vendor advises that network operators should reject routes with unusually long AS_PATH attributes to prevent exploitation. Operators should implement route filtering policies to block excessively long AS_PATHs as a mitigation measure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.