The BIRD Internet Routing Daemon does not enforce the RFC 8956 requirement that a destination prefix component in a FlowSpec rule must have a zero offset. Because of this, an attacker who has an established BGP session can inject FlowSpec filters that match IPv6 addresses outside the authorized unicast route set. If export policy allows, the compromised rules can flow downstream, causing unauthorized traffic filtering or traffic redirection.

All releases of the CZ.NIC BIRD Internet Routing Daemon are potentially affected until a proven upstream fix is applied. No specific version information is listed in the CNA data.

The vulnerability has a CVSS score of 2.3, indicating a low severity impact. EPSS is not available, and the issue is not listed in CISA’s KEV catalog. Exploitation requires an existing BGP session, so the attacker must be a BGP peer of the target, which implies remote but authenticated access. Given the low CVSS score and limited preconditions, the likelihood of exploitation is considered low, but it remains possible in environments that export FlowSpec routes to downstream peers.