Re: BIRD/BIRD2: stack buffer overflow in BGP AS_PATH mask matching, CVE pending

[Dan Yefihmov <dan () lightwave net ru>]

On June 2, 2026 1:56:57 PM GMT+03:00, Stuart Henderson <stu () spacehopper org> wrote:
> On 2026/06/02 10:07, Bakabaka_9 wrote:
> > Tested affected:
> >
> > - BIRD 2.16.2
> >
> > Possibly affected:
> >
> > - Other BIRD 2.x versions using the same AS_PATH mask matching
> >   implementation.
> >
> > Not affected:
> >
> > - Unknown.
> >
> > Fixed version
> > =============
> >
> > No fixed version is available at the time of this disclosure.
>
> If you've only tried one version from April 2025, how can you can say
> with certainty that it's not been fixed since then?
Did you really read the report carefully? It's explicitly written there that on May 24 the maintainers clearly written 
they don't currently plan to fix it!


Sincerely Yours, Dan.