Re: BIRD/BIRD2: stack buffer overflow in BGP AS_PATH mask matching, CVE pending

[Stuart Henderson <stu () spacehopper org>]

On 2026/06/02 21:14, Dan Yefihmov wrote:
> On June 2, 2026 8:27:14 PM GMT+03:00, Stuart Henderson <stu () spacehopper org> wrote:
> > Yes, I did. That doesn't rule out things like "don't plan to fix because
> > it's no longer an issue".
> Didn't you think that in that case it's considerably more reasonable to explicitly write: "It's already fixed, and 
> the fix will be in the next release scheduled at ..." instead of "We don't CURRENTLY plan to fix it"?

I'm not sure if you're aware of the sheer number of reports that
widely-used projects are receiving recently.

> From the talk I linked to, for BIRD from the start of 2026 up to 19 May,
that was *70*. The ones I've seen (not for BIRD) they're often extremely
verbose, and they're often plain wrong (the talk suggests ~ 9% of the
reports for BIRD were valid).

At this point I think it is fairly reasonable for small development
teams to not spend all that much time researching a lower-effort
report. If it's valid there will likely be a handful of duplicate
reports coming along soon afterwards anyway, and hopefully one of
those may have done more triage before sending out.