Vulnerability · Published May 27, 2026 · Assigned by GitHub_M

CVE-2026-45047bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding

High 7.5

In plain English

A high-severity uncontrolled resource consumption in bird-lg-go from xddxdd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 61.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(&request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/xddxdd/bird-lg-go	0.0.0-20260507060110-0ff87024cb9e	GHSA-39qr-rc93-vhqm
Go	github.com/xddxdd/bird-lg-go	0.0.0-20260507060110-0ff87024cb9e	GO-2026-5077

Affected products (as reported)

Vendor	Product	Versions
xddxdd	bird-lg-go	< 1.4.5

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm x_refsource_CONFIRM