debian/bird vulnerabilities

Latest debian/bird CVEs

Newest publication first

1. CVE-2026-49943 bird: BIRD Internet Routing Daemon: Denial of Service via stack-based buffer overflow in BGP AS_PATH processing

   Published 2026-06-02

   Medium·CVSS 6.3 EPSS 0.30%

   CZ.NIC BIRD Internet Routing Daemon through 2.19.0 contains a stack-based buffer overflow in the BGP AS_PATH mask matching implementation in nest/a-path.c. The as_path_match() function uses a fixed-size stack array of 2048 + 1 pm_pos entries, while parse_path() expands AS_PATH se...

2. DSA-4528-1 bird - security update

   Published 2019-09-19

   Unknown

3. CVE-2019-16159 BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included....

   Published 2019-09-09

   High·CVSS 7.5 EPSS 3.2%

   BIRD Internet Routing Daemon 1.6.x through 1.6.7 and 2.x through 2.0.5 has a stack-based buffer overflow. The BGP daemon's support for RFC 8203 administrative shutdown communication messages included an incorrect logical expression when checking the validity of an input message....

4. CVE-2018-12066 BIRD Internet Routing Daemon before 1.6.4 allows local users to cause a denial of service (stack consumption and daemon crash) via BGP mask expressions in birdc.

   Published 2018-06-08

   Medium·CVSS 5.5 EPSS 0.39%

   BIRD Internet Routing Daemon before 1.6.4 allows local users to cause a denial of service (stack consumption and daemon crash) via BGP mask expressions in birdc.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.