CVE-2026-112112 nic CVE debrief

Who should care

Network administrators and security teams responsible for BIRD Internet Routing Daemon deployment and configuration should assess exposure and verify validation configuration. They should also monitor for suspicious FlowSpec rule injections and review compensating controls for exposed systems.

Why it matters

The IPv6 FlowSpec validation bypass vulnerability in BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the authorized address space, potentially causing unauthorized traffic filtering or redirection.

• Verify validation configuration to prevent unauthorized FlowSpec rule injections
• Assess exposure to potential traffic filtering or redirection

Technical summary

The CZ.NIC BIRD Internet Routing Daemon is vulnerable to an IPv6 FlowSpec validation bypass, allowing an established BGP peer to inject FlowSpec rules matching destinations outside the authorized address space. This vulnerability arises from improper validation of the destination prefix component in FlowSpec rules, specifically when the component includes a nonzero offset. As a result, an attacker could potentially inject malicious FlowSpec rules that are not properly validated, leading to unauthorized traffic filtering or redirection.

Defensive priority

Assess exposure and verify validation configuration for BIRD Internet Routing Daemon.

Recommended defensive actions

• Assess exposure and verify validation configuration for BIRD Internet Routing Daemon.
• Verify patch application and configuration.
• Monitor for suspicious FlowSpec rule injections.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the IPv6 FlowSpec validation bypass vulnerability in BIRD Internet Routing Daemon. Evidence is limited to public CVE and source-item data. Defenders should verify configuration and patch status with vendors, assess exposure, and monitor for suspicious FlowSpec rule injections. Additional evidence may be available in vendor advisories and technical documentation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.