Unrated severityNVD Advisory· Published Mar 4, 2026· Updated Mar 4, 2026
CVE-2026-26514
CVE-2026-26514
Description
An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags (e.g., -w, -q) via the q parameter. This can be exploited to cause a Denial of Service (DoS) by exhausting system resources.
Affected products
2- bird-lg-go/bird-lg-godescription
- Range: < commit 6187a4e
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2News mentions
0No linked articles in our index yet.