CVE-2026-26514
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
4Description
An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags (e.g., -w, -q) via the q parameter. This can be exploited to cause a Denial of Service (DoS) by exhausting system resources.
Analysis
Remote attackers can inject arbitrary command-line arguments into bird-lg-go's traceroute module through unsanitized user input, enabling denial-of-service attacks that exhaust system resources. The vulnerability affects Golang and bird-lg-go installations prior to commit 6187a4e, and public exploit code exists. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Remediation
Within 24 hours: Inventory all bird-lg-go instances and assess exposure to untrusted networks. Within 7 days: Apply the available patch (commit 6187a4e or later) to all affected systems and validate traceroute functionality. …
Sign in for detailed remediation steps.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today