CVE-2026-49943: BIRD Routing Daemon Buffer Overflow Flaw

CVE-2026-49943 Overview

CVE-2026-49943 is a stack-based buffer overflow [CWE-121] in the CZ.NIC BIRD Internet Routing Daemon through version 2.19.0. The flaw resides in the as_path_match() function in nest/a-path.c, which uses a fixed-size stack array of 2048 + 1 pm_pos entries. The parse_path() routine expands Border Gateway Protocol (BGP) AS_PATH segments from received UPDATE messages without enforcing a matching capacity limit. An established BGP peer can transmit an AS_PATH containing more than 2048 expanded Autonomous System Numbers (ASNs) and crash the daemon.

Critical Impact
An authenticated BGP peer can trigger a stack buffer overflow that terminates the BIRD routing daemon, disrupting route propagation across the affected network.

Affected Products

CZ.NIC BIRD Internet Routing Daemon versions through 2.19.0
Deployments with RFC 8654 BGP Extended Messages enabled
BIRD instances using filter expressions evaluating AS path masks (for example, bgp_path ~ [= ... =])

Discovery Timeline

2026-06-02 - CVE-2026-49943 published to the National Vulnerability Database (NVD)
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-49943

Vulnerability Analysis

The vulnerability stems from a mismatch between two related code paths handling BGP AS_PATH attributes in BIRD. The as_path_match() function allocates a fixed stack buffer sized for 2049 pm_pos entries. The companion parse_path() function expands AS_PATH segments from incoming BGP UPDATE messages without bounding the expansion to that capacity. When RFC 8654 BGP Extended Messages are enabled, peers can send AS_PATH attributes far larger than the legacy 4096-byte ceiling, producing more than 2048 expanded ASNs.

Filter expressions that evaluate AS path masks, such as bgp_path ~ [= ... =], invoke the vulnerable matching path. The expansion writes beyond the fixed stack buffer, corrupting adjacent stack memory and crashing the daemon. The reporter notes the supplier does not consider a fix a priority, arguing operators should already reject routes carrying unusually long attributes.

Root Cause

The root cause is missing capacity enforcement in parse_path() relative to the static buffer size assumed by as_path_match(). The function lacks a bounds check tying the expanded ASN count to the 2049-entry buffer in nest/a-path.c.

Attack Vector

Exploitation requires an established BGP session, so the attacker must control a peer or compromise an upstream router. The target BIRD instance must have RFC 8654 Extended Messages negotiated and a filter referencing an AS path mask. The attacker then advertises a route whose AS_PATH expands to more than 2048 ASNs, triggering the overflow during filter evaluation and crashing the daemon.

No verified public proof-of-concept code is available. See the GitLab Bird Project News and the CZ.NIC Bird Project for upstream technical context.

Detection Methods for CVE-2026-49943

Indicators of Compromise

Unexpected termination or repeated restarts of the bird daemon process on routers running version 2.19.0 or earlier
BGP session resets correlated with receipt of UPDATE messages containing oversized AS_PATH attributes
Core dumps from BIRD showing stack corruption within as_path_match() or parse_path() frames

Detection Strategies

Inspect BGP telemetry for UPDATE messages whose AS_PATH attribute exceeds operational norms, particularly those with more than 2048 ASNs
Monitor for sessions that negotiate RFC 8654 Extended Messages and subsequently exchange AS_PATH attributes larger than 4096 bytes
Correlate daemon crashes with peer activity to identify the originating session

Monitoring Recommendations

Enable verbose BGP UPDATE logging on BIRD instances to capture attribute lengths and peer identities
Forward bird process exit events and core dumps to a centralized logging pipeline for correlation
Track BGP session uptime metrics and alert on flap patterns aligned with received long-path advertisements

How to Mitigate CVE-2026-49943

Immediate Actions Required

Audit BIRD configurations for filter expressions using AS path mask matching, such as bgp_path ~ [= ... =], and remove or rewrite them where feasible
Disable RFC 8654 BGP Extended Messages on sessions that do not strictly require them to cap AS_PATH attribute size
Apply inbound AS_PATH length limits at the BGP peer level to reject advertisements with abnormally long paths

Patch Information

The supplier has stated that a fix is not being prioritized, citing the expectation that operators reject routes with unusually long attributes. Track upstream changes through the GitLab Bird Project News for any future remediation.

Workarounds

Enforce a maximum AS_PATH length using inbound filters that discard routes exceeding a conservative ASN count well below 2048
Restrict BGP peering to trusted neighbors and apply strict prefix and attribute policies on external sessions
Avoid enabling Extended Messages capability on sessions where peers do not require AS_PATH attributes beyond the legacy size limit

bash

# Example BIRD filter snippet to reject overly long AS_PATHs
filter reject_long_aspath {
    if bgp_path.len > 256 then reject;
    accept;
}