CVE-2026-49943

Name of the Vulnerable Software and Affected Versions CZ.NIC BIRD Internet Routing Daemon versions prior to 2.19.0

Description A stack-based buffer overflow exists in the BGP AS PATH mask matching implementation within the nest/a-path.c file. The as path match() function utilizes a fixed-size stack array of 2048 + 1 pm pos entries, but the parse path() function expands AS PATH segments from received BGP UPDATE messages without enforcing a capacity limit. When RFC 8654 BGP Extended Messages are enabled and a BIRD filter evaluates an AS path mask expression, an established BGP peer can send a long AS PATH containing more than 2048 expanded ASNs. This leads the parse path() and as path match() functions to write beyond the fixed stack buffer, causing the daemon to crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.