CVE-2026-45047: bird-lg-go DOS Vulnerability

CVE-2026-45047 Overview

CVE-2026-45047 is a memory exhaustion vulnerability in bird-lg-go, a BIRD looking glass implementation written in Go. The flaw exists in versions prior to 1.4.5 and stems from unbounded JSON payload processing in the apiHandler and webHandlerTelegramBot functions. An unauthenticated remote attacker can stream an extremely large JSON payload over a single TCP connection, causing the Go runtime to allocate memory until the host exhausts physical RAM or container limits. The result is an unrecoverable fatal error: runtime: out of memory condition. The maintainers fixed this issue in version 1.4.5.

Critical Impact
Unauthenticated remote attackers can crash bird-lg-go instances by streaming oversized JSON payloads, producing a denial of service against network operators relying on the looking glass.

Affected Products

bird-lg-go versions prior to 1.4.5
apiHandler endpoint handler component
webHandlerTelegramBot handler component

Discovery Timeline

2026-05-27 - CVE-2026-45047 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45047

Vulnerability Analysis

The vulnerability is classified under [CWE-400] Uncontrolled Resource Consumption. The bird-lg-go proxy component exposes HTTP endpoints that accept JSON-encoded requests from clients. These endpoints invoke json.NewDecoder(r.Body).Decode(&request) directly on the incoming HTTP body without enforcing any byte limit. Go's standard JSON decoder reads input from the supplied io.Reader and allocates Go data structures to represent the parsed content. When the input stream is arbitrarily large, the decoder continues consuming memory until the process exhausts available resources.

The attack succeeds over a single TCP connection because the decoder does not require the payload to terminate before allocation begins. Streaming gigabytes of padding inside a valid JSON structure forces the runtime to grow internal buffers and parsed objects until the kernel out-of-memory killer or the container memory cgroup terminates the process.

Root Cause

The root cause is the absence of an http.MaxBytesReader wrapper or equivalent size guard around the request body before deserialization. The handlers trust the client to provide reasonably sized input. Without that bound, attacker-controlled payload size directly maps to attacker-controlled memory allocation in the server process.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends an HTTP POST request to a vulnerable bird-lg-go endpoint with a JSON body containing very large strings, arrays, or deeply nested objects. The connection remains open while the attacker streams padding bytes. The decoder allocates memory progressively until the process crashes. Repeated requests prevent service recovery and produce a sustained denial of service against the looking glass.

No verified exploit code is publicly available. See the GitHub Security Advisory for additional technical details.

Detection Methods for CVE-2026-45047

Indicators of Compromise

bird-lg-go process termination with fatal error: runtime: out of memory messages in service logs or systemd journal entries
Kernel oom-killer events targeting the bird-lg-go binary in /var/log/messages or dmesg output
HTTP POST requests to bird-lg-go API endpoints with abnormally large Content-Length values or chunked transfer-encoded bodies that remain open for extended periods

Detection Strategies

Monitor resident set size (RSS) of bird-lg-go processes for rapid memory growth that exceeds historical baselines
Alert on repeated process restarts or container OOM kills associated with the looking glass workload
Inspect reverse proxy or load balancer access logs for inbound POST requests to bird-lg-go paths with oversized request bodies

Monitoring Recommendations

Configure container memory limits and emit telemetry when cgroup memory pressure events occur for the bird-lg-go workload
Forward web server, reverse proxy, and host syslog data to a centralized analytics platform for correlation between request patterns and process crashes
Track HTTP request body sizes at the proxy layer and flag clients submitting requests above an operational threshold

How to Mitigate CVE-2026-45047

Immediate Actions Required

Upgrade bird-lg-go to version 1.4.5 or later, which contains the official fix
Restrict network access to the bird-lg-go proxy and Telegram bot endpoints using firewall rules or ACLs until patching is complete
Place a reverse proxy in front of bird-lg-go that enforces a hard request body size limit

Patch Information

The maintainers resolved CVE-2026-45047 in bird-lg-go version 1.4.5. The fix introduces a maximum read size around the JSON decoding path so that oversized payloads are rejected before the decoder allocates unbounded memory. Refer to the GitHub Security Advisory GHSA-39qr-rc93-vhqm for the official patch notes and commit reference.

Workarounds

Deploy bird-lg-go behind a reverse proxy such as nginx or HAProxy and configure a client_max_body_size directive set to a small value appropriate for legitimate API traffic
Apply container memory limits and automatic restart policies so a successful attack causes only brief service interruption rather than host-wide impact
Restrict access to the bird-lg-go HTTP endpoints to trusted source networks using firewall rules or authenticated reverse proxy access

bash

# Example nginx reverse proxy configuration limiting request body size
server {
    listen 443 ssl;
    server_name lg.example.net;

    client_max_body_size 64k;
    client_body_buffer_size 16k;

    location / {
        proxy_pass http://127.0.0.1:5000;
        proxy_read_timeout 10s;
        proxy_send_timeout 10s;
    }
}