7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45047

CVE-2026-45047: bird-lg-go: Fatal Out-of-Memory (OOM) Denial of Service via Unbounded JSON Decoding

bird-lg-go is a BIRD looking glass in Go. Prior to 1.4.5, the apiHandler (and similarly webHandlerTelegramBot) processes user-provided JSON payloads by directly using json.NewDecoder(r.Body).Decode(&request) without restricting the maximum read size. An unauthenticated remote attacker can stream an extremely large, endless JSON payload (e.g., several Gigabytes of padding) over a single TCP connection. Because Go's JSON decoder attempts to allocate memory for the entire parsed structure, this rapidly exhausts the host's physical RAM or container limits, leading to an unrecoverable fatal error: runtime: out of memory. This vulnerability is fixed in 1.4.5.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45047

CVE-2026-45047:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/xddxdd/bird-lg-go	go	< 0.0.0-20260507060110-0ff87024cb9e	0.0.0-20260507060110-0ff87024cb9e

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic unbounded resource consumption issue. The application's API and Telegram webhook handlers accepted JSON payloads without imposing any limit on the size of the request body. The Go json.Decoder attempts to parse the entire payload, which requires allocating memory for the data structure. An unauthenticated attacker could exploit this by sending a continuous stream of JSON data (e.g., gigabytes of whitespace or padding) in a single request. This forces the application to try and allocate an impossible amount of memory, triggering a fatal runtime: out of memory error, which in turn causes the Linux OOM killer to terminate the process, resulting in a denial of service. The patch addresses this by wrapping the request body with http.MaxBytesReader, which enforces a maximum read size before the JSON decoding begins. The analysis of the commit 0ff87024cb9ed01fc5f5fdc6f4603fce4c123922 clearly shows this mitigation being applied to both the apiHandler and webHandlerTelegramBot functions, confirming they were the points of vulnerability.

Vulnerable functions

apiHandler

frontend/api.go

The `apiHandler` function processes API requests by decoding a JSON payload from the request body. Before the patch, it used `json.NewDecoder(r.Body).Decode(&request)` directly, without limiting the size of the incoming request. An attacker could stream an extremely large JSON payload, causing the Go JSON decoder to attempt to allocate an enormous amount of memory, leading to a fatal out-of-memory error and crashing the service.

webHandlerTelegramBot

frontend/telegram_bot.go

The `webHandlerTelegramBot` function handles webhooks from Telegram. It was also decoding JSON from the request body without any size limits. This exposed the same denial-of-service vulnerability as `apiHandler`, where a malicious, oversized JSON payload could be sent to exhaust system memory and cause the application to terminate.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.