CVE-2026-45047: bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding

Synopsis

An unbounded JSON decoding vulnerability in bird-lg-go allows a remote, unauthenticated attacker to exhaust all available memory on the host. By streaming an arbitrarily large JSON payload over a single TCP connection, the attacker triggers Go's runtime allocator to consume gigabytes of RAM until the process dies with a fatal out-of-memory error. Successful exploitation crashes the looking-glass service completely, causing a denial of service. A fix was published in version 1.4.5; HarborGuard tracks this advisory and a patched-image rebuild will become available the moment upstream publishes a fixed release to matched feeds.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the bird-lg-go HTTP API over the network; the service exposes the vulnerable endpoint remotely over TCP.

• AuthenticationNot required

  No credentials or session token are needed; the vulnerable apiHandler accepts unauthenticated requests.

• Victim interactionNot required

  No user action is required; the attacker initiates the exploit entirely by sending a crafted request to the server.

• Attack complexityDetail

  Exploitation is straightforward and condition-free: streaming an oversized JSON payload over a single connection reliably exhausts memory without requiring any race condition or special environment state.

Blast Radius

• Crashes the bird-lg-go process with a fatal out-of-memory runtime error, taking the looking-glass service fully offline.
• Exhausts physical RAM or container memory limits on the host, which can pressure or destabilize co-located processes and workloads sharing the same node.
• Service recovery requires a manual or orchestrated restart, leaving the network visibility tool unavailable for the duration of the outage.