{"id":"CVE-2026-112112","published":"2026-10-18T23:16:56.767","lastModified":"2026-10-19T21:14:14.150","description":"An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-1284"],"vendors":[],"products":[],"references":[{"url":"https://gitlab.nic.cz/labs/bird/-/blob/v2.20.0/nest/rt-table.c#L2686","tags":[]},{"url":"https://gitlab.nic.cz/labs/bird/-/blob/v3.4.0/nest/rt-table.c#L4518","tags":[]},{"url":"https://gitlab.nic.cz/labs/bird/-/commit/7cf75587b6f38b87849fe192bf5dfd124b7702bc","tags":[]},{"url":"https://www.rfc-editor.org/rfc/rfc8956.html#section-5","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}