A critical argument injection vulnerability in bird-lg-go allows unauthenticated remote attackers to trigger a Denial of Service condition through malicious input.

The application utilizes an insecure method to parse user input within the traceroute module, specifically failing to validate the q parameter. An unauthenticated remote attacker can inject arbitrary command flags to force resource exhaustion.

The vulnerability carries a CVSS score of 7.5, reflecting a significant risk to service availability. Successful exploitation allows an attacker to crash the application or degrade system performance, potentially resulting in extended downtime for users relying on the bird-lg-go looking glass service.

Immediate Action: Update the bird-lg-go installation to commit 6187a4e or later to apply the necessary input validation fixes.

Proactive Monitoring: Monitor system resource usage, specifically CPU and memory spikes associated with traceroute requests, and review web server access logs for anomalous flag patterns in the q parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and sanitize incoming HTTP requests, specifically blocking requests containing unexpected flags or special characters in the q parameter.

Public Exploit Available: No (There is no confirmed public exploit available in the provided data).

Given the potential for service disruption and the existence of a proof-of-concept, organizations running bird-lg-go must prioritize this update. Administrators should verify their current commit hash and apply the fix immediately to prevent exploitation and maintain service stability.