CVE-2026-26514: 
Linux Alpine vulnerability analysis and mitigation

CVE-2026-26514 is an Argument Injection vulnerability (CWE-88) in bird-lg-go, a BIRD looking glass implementation written in Go. The flaw exists in the traceroute module of all versions prior to commit 6187a4e (version 1.4.1), where user-supplied input is parsed via shlex.Split without validation, allowing remote attackers to inject arbitrary command-line flags into the underlying traceroute command. It was reported on January 11, 2026, and publicly disclosed on March 4, 2026, with a patch released shortly after. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (RedHat CVE, GitHub Issue).

The root cause is improper neutralization of argument delimiters (CWE-88) in the traceroute handler within proxy/traceroute.go. The handler retrieves the q URL query parameter and passes it directly to shlex.Split, which tokenizes the string into shell-like arguments — including any injected flags — without stripping or validating flag-style tokens (e.g., those beginning with -). An attacker can craft a request such as GET /traceroute?q=192.0.2.1%20-w%2060%20-q%2010%20-m%2050, causing the backend to invoke traceroute 192.0.2.1 -w 60 -q 10 -m 50 against an unreachable IP, forcing long-running processes that exhaust PIDs or memory. No authentication or user interaction is required (GitHub Issue, GitHub Commit).

Successful exploitation causes a Denial of Service (DoS) by exhausting server resources (process IDs or memory) through the creation of numerous long-running traceroute child processes. Because the attack requires no authentication and is network-accessible, any internet-exposed bird-lg-go proxy instance is at risk. There is no confidentiality or integrity impact; the vulnerability is limited to availability (RedHat CVE, GitHub Issue).

1. Reconnaissance: Identify internet-facing bird-lg-go proxy instances (typically exposed as network looking glass web services) using search engines like Shodan or Censys, or by scanning for the default bird-lg-go HTTP service port.
2. Identify the traceroute endpoint: Locate the /traceroute HTTP endpoint on the target proxy, which accepts a q query parameter for the traceroute target.
3. Craft the injection payload: Construct a URL with an injected payload in the q parameter that includes a black-hole IP and flags to maximize resource consumption, e.g., q=192.0.2.1%20-w%2060%20-q%2010%20-m%2050 (decoded: 192.0.2.1 -w 60 -q 10 -m 50).
4. Send repeated requests: Issue a high volume of concurrent GET requests to /traceroute?q=192.0.2.1%20-w%2060%20-q%2010%20-m%2050 using tools like curl, ab, or custom scripts. Each request spawns a long-running traceroute process targeting an unreachable IP with extended timeouts and high probe counts.
5. Resource exhaustion: The accumulation of hung traceroute child processes exhausts available PIDs or memory on the proxy server, rendering the bird-lg-go service (and potentially the host) unavailable (GitHub Issue).

• Network: High volume of HTTP GET requests to /traceroute endpoint with URL-encoded spaces and flag-like tokens (e.g., -w, -q, -m) in the q parameter; requests targeting RFC 5737 documentation IPs (e.g., 192.0.2.1, 198.51.100.1, 203.0.113.1).
• Process: Abnormally large number of traceroute child processes spawned by the bird-lg-go proxy process; processes with unusually high -w (wait) or -q (probes) arguments visible in ps aux or /proc.
• Logs: HTTP access logs showing repeated requests to /traceroute?q= with encoded whitespace and flag characters from one or multiple source IPs; HTTP 503 responses if the concurrency limit patch is applied and being triggered.
• System: Elevated process count approaching system PID limits; increased memory consumption on the proxy host correlating with traceroute request spikes (GitHub Issue, GitHub Commit).

Upgrade bird-lg-go to version 1.4.1 or later, which includes commit 6187a4e. The patch introduces a configurable concurrency semaphore (traceroute_max_concurrent, defaulting to 10) that limits the number of simultaneous traceroute requests and returns HTTP 503 when the limit is exceeded. As a temporary workaround prior to patching, restrict network access to the bird-lg-go proxy service to trusted IP ranges only, and consider implementing rate limiting at the reverse proxy or firewall level (GitHub Commit, RedHat CVE).

The vulnerability was initially reported (in Chinese) by a community member on January 11, 2026, via the bird-lg-go GitHub issue tracker, and the maintainer responded with a patch. Coverage was picked up by automated vulnerability feeds including The Hacker Wire, VulnDB, and INCIBE-CERT shortly after public disclosure on March 4, 2026. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregator reporting (GitHub Issue).