{"schema":"threatline.record/2","record":{"id":"CVE-2026-112112","aliases":[],"summary":"An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the ","details":"An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.","categories":["Unclassified"],"product":"BIRD","vendor":"nic","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112112","source_modified_at":"2026-10-19T18:41:47.949Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"BIRD","vendor":"nic","versions":[{"lessThanOrEqual":"2.20.0","status":"affected","version":"2.0.9","versionType":"semver"},{"lessThanOrEqual":"3.4.0","status":"affected","version":"3.0.0","versionType":"semver"}],"defaultStatus":"unknown"}],"fixed_versions":[],"cvss":2.3,"severity":"Low","kev":{"listed":false},"epss":{"probability":0.00307,"percentile":0.22371,"score_date":"2026-10-23"},"published_at":"2026-10-18T23:01:05.633Z","modified_at":"2026-10-19T18:41:47.949Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-112112","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T18:41:47.949Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-112112","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://gitlab.nic.cz/labs/bird/-/commit/7cf75587b6f38b87849fe192bf5dfd124b7702bc","tags":["patch"]},{"source":"CVE List","url":"https://www.rfc-editor.org/rfc/rfc8956.html#section-5"},{"source":"CVE List","url":"https://gitlab.nic.cz/labs/bird/-/blob/v2.20.0/nest/rt-table.c#L2686"},{"source":"CVE List","url":"https://gitlab.nic.cz/labs/bird/-/blob/v3.4.0/nest/rt-table.c#L4518"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-19T18:39:04.870755Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-19T18:41:47.949Z","content_hash":"ac6d9d8b0bded8fc8a6beb1aad92b0bfc590891fa7f7b23b25c5d3e1111e0465"}}