CVE-2026-45047Disclosure

LOWCVSS 7.5 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(&request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

https://github.com/xddxdd/bird-lg-go/security/advisories/GHSA-39qr-rc93-vhqm

Weakness type (CWE)

CWE-400

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
General: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

General

150.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

CVE@CVEnew137d
Disclosure
CVE-2026-45047 bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using… https://www.cve.org/CVERecord?id=CVE-2026-45047
Post summary
CVE-2026-45047 affects bird‑lg‑go prior to version 1.4.5, where JSON payloads handled by apiHandler and webHandlerTelegramBot can be directly used, likely leading to vulnerability. Updating to 1.4.5 or newer mitigates the issue.
00010300
57.5K followersView on X
Infoflowcloud@infoflowcloud137d
General
🚨*CVE* CVE-2026-45047 bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using… https://www.cve.org/CVERecord?id=CVE-2026-45047 ----- Traducción: CVE-2026-45047 bir… http://infoflow.cloud`
Post summary
A brief mention of CVE‑2026‑45047 affecting bird-lg-go with partially described JSON handling, but no PoC, exploit, patch, or active exploitation details are provided.
0000032
79 followersView on X

Explore more

Back to dashboard