CVE-2026-26514
An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without val...
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags (e.g., -w, -q) via the q parameter. This can be exploited to cause a Denial of Service (DoS) by exhausting system resources.
Références
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com