Search
Find a vulnerability
Search criteria
2 vulnerabilities by xddxdd
CVE-2026-63644 (GCVE-0-2026-63644)
Vulnerability from cvelistv5 – Published: 2026-11-09 21:22 – Updated: 2026-11-09 21:22
VLAI
EPSS
VEX
Title
bird-lg-go: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') and Exposure of Sensitive Information to an Unauthorized Actor in github.com/xddxdd/bird-lg-go
Summary
bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. This issue has been patched in version 1.4.7.
Severity
7.5 (High)
CWE
Assigner
GitHub_M
CNA
References
3 references
| URL | Tags |
|---|---|
| https://github.com/xddxdd/bird-lg-go/security/adv… | x_refsource_CONFIRM |
| https://github.com/xddxdd/bird-lg-go/commit/74762… | x_refsource_MISC |
| https://github.com/xddxdd/bird-lg-go/releases/tag… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xddxdd | bird-lg-go |
Affected:
< 1.4.7
|
{
"containers": {
"cna": {
"affected": [
{
"product": "bird-lg-go",
"vendor": "xddxdd",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. This issue has been patched in version 1.4.7."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-88",
"description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:22:21.131Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-3qm5-22pm-wqg9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-3qm5-22pm-wqg9"
},
{
"name": "https://github.com/xddxdd/bird-lg-go/commit/74762e4be0d5f19edd710ebfae5b8e8c5bb30e32",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xddxdd/bird-lg-go/commit/74762e4be0d5f19edd710ebfae5b8e8c5bb30e32"
},
{
"name": "https://github.com/xddxdd/bird-lg-go/releases/tag/v1.4.7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/xddxdd/bird-lg-go/releases/tag/v1.4.7"
}
],
"source": {
"advisory": "GHSA-3qm5-22pm-wqg9",
"discovery": "UNKNOWN"
},
"title": "bird-lg-go: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027) and Exposure of Sensitive Information to an Unauthorized Actor in github.com/xddxdd/bird-lg-go"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63644",
"datePublished": "2026-11-09T21:22:21.131Z",
"dateReserved": "2026-07-17T14:11:15.483Z",
"dateUpdated": "2026-11-09T21:22:21.131Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-45047 (GCVE-0-2026-45047)
Vulnerability from cvelistv5 – Published: 2026-05-27 16:37 – Updated: 2026-05-27 18:03
VLAI
EPSS
VEX
Title
bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding
Summary
bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(&request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-27 18:03 UTC
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
GitHub_M
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/xddxdd/bird-lg-go/security/adv… | x_refsource_CONFIRM |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| xddxdd | bird-lg-go |
Affected:
< 1.4.5
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-45047",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-27T18:03:03.834690Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T18:03:10.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "bird-lg-go",
"vendor": "xddxdd",
"versions": [
{
"status": "affected",
"version": "\u003c 1.4.5"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(\u0026request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go\u0027s JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host\u0027s physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-27T16:37:36.191Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm"
}
],
"source": {
"advisory": "GHSA-39qr-rc93-vhqm",
"discovery": "UNKNOWN"
},
"title": "bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-45047",
"datePublished": "2026-05-27T16:37:36.191Z",
"dateReserved": "2026-05-08T18:07:27.341Z",
"dateUpdated": "2026-05-27T18:03:10.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}