Bird Lg Go
Approved changes feed: RSS · Atom
cpe:2.3:a:xddxdd:bird-lg-go:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Xddxdd (d08c1db2-a561-5a35-baa8-9e5095c392dd) |
|---|---|
| Product | Bird Lg Go (7e3bef0a-b18e-56fe-97e2-29cbc5344566) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/xddxdd/bird-lg-go |
purl2cpe | 2026-06-01 10:17:27.226246 |
pkg:golang/github.com/xddxdd/bird-lg-go |
purl2cpe | 2026-06-01 10:17:27.226248 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-45047 |
vulnerable | 2026-06-08 08:05:11.442388 |
bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding
HIGH (7.5)
bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(&request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5.
Published: 2026-05-27T16:37:36.191Z
Updated: 2026-05-27T18:03:10.363Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.