Vulnerability · Published Jun 2, 2026 · Assigned by mitre
CVE-2026-49943
Medium 6.3
In plain English
A medium-severity stack buffer overflow in BIRD from NIC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH segments from a received BGP UPDATE without enforcing a corresponding capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression such as "bgp_path ~ [= ... =]", an established BGP peer can send a long AS_PATH containing more than 2048 expanded ASNs. This causes parse_path()/as_path_match() to write beyond the fixed stack buffer, resulting in a crash of the daemon. NOTE: reportedly, the Supplier's position is that a fix is not being prioritized because all network operators should already be rejecting routes with unusually long attributes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | bird | no fix listed | DEBIAN-CVE-2026-49943 |
| Debian:12 | bird2 | no fix listed | DEBIAN-CVE-2026-49943 |
| Debian:13 | bird2 | no fix listed | DEBIAN-CVE-2026-49943 |
| Debian:14 | bird2 | no fix listed | DEBIAN-CVE-2026-49943 |
| Debian:13 | bird3 | no fix listed | DEBIAN-CVE-2026-49943 |
| Debian:14 | bird3 | no fix listed | DEBIAN-CVE-2026-49943 |
| Ubuntu:22.04:LTS | bird | no fix listed | UBUNTU-CVE-2026-49943 |
| Ubuntu:24.04:LTS | bird | no fix listed | UBUNTU-CVE-2026-49943 |
| Ubuntu:22.04:LTS | bird2 | no fix listed | UBUNTU-CVE-2026-49943 |
| Ubuntu:24.04:LTS | bird2 | no fix listed | UBUNTU-CVE-2026-49943 |
| Ubuntu:25.10 | bird2 | no fix listed | UBUNTU-CVE-2026-49943 |
| Ubuntu:26.04:LTS | bird2 | no fix listed | UBUNTU-CVE-2026-49943 |
| Ubuntu:26.10 | bird2 | no fix listed | UBUNTU-CVE-2026-49943 |
| Ubuntu:25.10 | bird3 | no fix listed | UBUNTU-CVE-2026-49943 |
| Ubuntu:26.04:LTS | bird3 | no fix listed | UBUNTU-CVE-2026-49943 |
| Ubuntu:26.10 | bird3 | no fix listed | UBUNTU-CVE-2026-49943 |
Affected products (as reported)
Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H