{"id":"CVE-2026-112112","details":"An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.","modified":"2026-10-19T10:45:22.042494799Z","published":"2026-10-18T23:01:05.633Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-1284"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112112.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/112xxx/CVE-2026-112112.json"},{"type":"PACKAGE","url":"https://gitlab.nic.cz/labs/bird"},{"type":"WEB","url":"https://gitlab.nic.cz/labs/bird/-/blob/v2.20.0/nest/rt-table.c#L2686"},{"type":"WEB","url":"https://gitlab.nic.cz/labs/bird/-/blob/v3.4.0/nest/rt-table.c#L4518"},{"type":"FIX","url":"https://gitlab.nic.cz/labs/bird/-/commit/7cf75587b6f38b87849fe192bf5dfd124b7702bc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112112"},{"type":"WEB","url":"https://www.rfc-editor.org/rfc/rfc8956.html#section-5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://gitlab.nic.cz/labs/bird","events":[{"introduced":"eb859a3fb063b261fb76304e5b8eca206e7a162a"},{"last_affected":"0355729c3a546c910e20bcde423bf36da901f8b5"},{"introduced":"e7bd976178a2b133c36492420c0ad0455253f81e"},{"last_affected":"c3669497e3949b942d86d07e343092cc439b4659"}],"database_specific":{"extracted_events":[{"introduced":"2.0.9"},{"last_affected":"2.20.0"},{"introduced":"3.0.0"},{"last_affected":"3.4.0"}],"source":"AFFECTED_FIELD"}}],"versions":["v2.20.0","v2.19.0","v2.18","v2.17.1","v2.17","v2.16","v2.15","v2.15.1","v2.14","v2.13","v2.0.12","v2.0.11","v2.0.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-112112.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}