CVE-2026-45047: Github.com/xddxdd/bird lg go Denial of Service Vulnerability
HIGHCVE-2026-45047 is a HIGH (CVSS 7.5) denial of service vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting Github.com/xddxdd/bird lg go libraries in the Go ecosystem. The issue involves bird-lg-go has a fatal out-of-memory (oom) denial of service via unbounded json decoding. Remediation is available by upgrading affected packages to version 0.0.0-20260507060110-0ff87024cb9e.
CVE-2026-45047 at a Glance
Security Impact
CVSS: 7.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
How to Fix CVE-2026-45047
To remediate this vulnerability, upgrade all affected Github.com/xddxdd/bird lg go dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/xddxdd/bird-lg-go to 0.0.0-20260507060110-0ff87024cb9eRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/xddxdd/bird-lg-goHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-45047, inspect your project dependencies for Github.com/xddxdd/bird lg go:
inspect dependencies for github.com/xddxdd/bird-lg-goAnalyze the terminal output to locate any version of Github.com/xddxdd/bird lg go in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20260507060110-0ff87024cb9e), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In Github.com/xddxdd/bird lg go, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-45047 Affected Github.com/xddxdd/bird lg go Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/xddxdd/bird-lg-go
|
Go |
< 0.0.0-20260507060110-0ff87024cb9e
|
0.0.0-20260507060110-0ff87024cb9e
|
References
Frequently Asked Questions
What is CVE-2026-45047?
Which Github.com/xddxdd/bird lg go versions are affected?
What version fixes CVE-2026-45047?
Is github.com/xddxdd/bird-lg-go affected?
What is the CVSS score of CVE-2026-45047?
What CWE is associated with CVE-2026-45047?
How can I check Go dependencies for CVE-2026-45047?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-39qr-rc93-vhqm",
"modified" : "2026-06-08T23:49:47Z",
"published" : "2026-05-11T16:17:48Z",
"aliases" : [ "CVE-2026-45047" ],
"summary" : "Bird-lg-go has a Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding",
"details" : "### Summary\nThe `apiHandler` (and similarly `webHandlerTelegramBot`) processes user-provided JSON payloads by directly using `json.NewDecoder(r.Body).Decode(&request)` without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable `fatal error: runtime: out of memory`. \n\nThis causes the Linux OOM Killer to instantly terminate the entire `bird-lg-go` daemon, resulting in a severe Remote Denial of Service (RDoS).\n\n### Details\nIn `api.go`:\n```go\nfunc apiHandler(w http.ResponseWriter, r *http.Request) {\n var request apiRequest\n // VULNERABILITY: No http.MaxBytesReader protection before JSON decode\n err := json.NewDecoder(r.Body).Decode(&request) \n // ...",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/xddxdd/bird-lg-go"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "0.0.0-20260507060110-0ff87024cb9e"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-45047"
}, {
"type" : "WEB",
"url" : "https://github.com/xddxdd/bird-lg-go/commit/0ff87024cb9ed01fc5f5fdc6f4603fce4c123922"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/xddxdd/bird-lg-go"
}, {
"type" : "WEB",
"url" : "https://github.com/xddxdd/bird-lg-go/releases/tag/v1.4.5"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-400" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-11T16:17:48Z",
"nvd_published_at" : "2026-05-27T18:16:24Z"
}
}