CVE-2026-26514: High severity github.com/bitnami-labs/bird-lg-go vulnerability
Published Mar 4, 2026
·Updated
An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags (e.g., -w, -q) via the q parameter. This can be exploited to cause a Denial of Service (DoS) by exhausting system resources.
Affected Software
2 affected components
github.com/bitnami-labs/bird-lg-go<6187a4e
Xddxdd Bird-lg-go Go<1.4.1
Remediation
Event History
Mar 4, 2026
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2026-26514?
CVE-2026-26514 is classified as a Denial of Service vulnerability.
2
How do I fix CVE-2026-26514?
To fix CVE-2026-26514, update to bird-lg-go version 1.4.1 or later.
3
What type of vulnerability is CVE-2026-26514?
CVE-2026-26514 is an Argument Injection vulnerability.
4
What component is affected by CVE-2026-26514?
The traceroute module of bird-lg-go is affected by CVE-2026-26514.
5
Can CVE-2026-26514 be exploited remotely?
Yes, CVE-2026-26514 can be exploited remotely by attackers.