CVE-2026-26514
📋 TL;DR
An argument injection vulnerability in bird-lg-go's traceroute module allows remote attackers to inject arbitrary command-line flags via the q parameter. This can lead to denial of service by exhausting system resources. Anyone running bird-lg-go before commit 6187a4e is affected.
💻 Affected Systems
- bird-lg-go
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system resource exhaustion leading to service unavailability and potential system instability
Likely Case
Temporary denial of service affecting bird-lg-go traceroute functionality
If Mitigated
Minimal impact with proper input validation and resource limits
🎯 Exploit Status
Exploitation requires sending specially crafted q parameter to traceroute endpoint
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 6187a4e3afce6d8c29568f8c72ca497d1f5a2b56 or later
Vendor Advisory: https://github.com/xddxdd/bird-lg-go/commit/6187a4e3afce6d8c29568f8c72ca497d1f5a2b56
Restart Required: Yes
Instructions:
1. Pull latest bird-lg-go repository
2. Apply commit 6187a4e or later
3. Rebuild and redeploy the application
4. Restart bird-lg-go service
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to reject q parameter containing special characters or flags
Implement regex filter: ^[a-zA-Z0-9.-]+$ for q parameter
Resource Limits
linuxImplement system resource limits for traceroute processes
ulimit -t 30
ulimit -m 100000
🧯 If You Can't Patch
- Disable traceroute functionality in bird-lg-go configuration
- Implement WAF rules to block requests containing suspicious q parameter values
🔍 How to Verify
Check if Vulnerable:
Check if bird-lg-go version is before commit 6187a4e by examining git log or version metadataCheck Version:
git log --oneline | head -5Verify Fix Applied:
Test traceroute endpoint with malicious q parameter (e.g., q=-w+100) and verify it's rejected📡 Detection & Monitoring
Log Indicators:
- Unusual traceroute parameters in access logs
- Multiple failed traceroute attempts with special characters
Network Indicators:
- HTTP requests to traceroute endpoint with unusual q parameter values
SIEM Query:
source="bird-lg-go" AND (q="-*" OR q="* *" OR q="*;*")