<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<meta name="generator" content="pandoc" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
<style>
html {
line-height: 1.2;
font-family: serif;
font-size: 0.9em;
color: black;
background-color: white;
}
body {
margin: 0;
margin-right: auto;
max-width: 36em;
padding: 1em;
hyphens: auto;
overflow-wrap: break-word;
text-rendering: optimizeLegibility;
font-kerning: normal;
}
@media print {
body {
background-color: transparent;
color: black;
font-size: 11pt;
}
p, h2, h3 {
orphans: 3;
widows: 3;
}
h2, h3, h4 {
page-break-after: avoid;
}
}
p {
margin: 1em 0;
}
a {
color: black;
}
a:visited {
color: black;
}
img {
max-width: 100%;
}
h1, h2, h3, h4, h5, h6 {
margin-top: 1.4em;
}
h5, h6 {
font-size: 1em;
font-style: italic;
}
h6 {
font-weight: normal;
}
ol, ul {
padding-left: 1.7em;
margin-top: 1em;
}
li > ol, li > ul {
margin-top: 0;
}
blockquote {
margin: 0.5em;
padding-left: 0.5em;
border-left: 2px solid #e6e6e6;
color: #444;
}
code {
font-family: 'Lucida Console', monospace;
font-size: 95%;
margin: 0;
}
pre {
margin: 1em 0;
overflow: auto;
max-width: unset;
width: fit-content;
}
pre code {
padding: 0;
overflow: visible;
overflow-wrap: normal;
max-width: unset;
white-space: pre-wrap;
}
pre code span {
white-space: pre;
}
.sourceCode {
background-color: transparent;
overflow: visible;
}
code.diff span.kw,
code.diff span.dt {
font-weight: bold;
}
code.diff span.va {
background-color: rgba(192, 255, 192, 64);
color: rgb(0, 64, 0);
}
code.diff span.st {
background-color: rgba(255, 192, 192, 64);
color: rgb(64, 0, 0);
}
pre.diff {
background-color: rgb(240, 240, 240);
padding: 0.4em;
border: 1pt solid grey;
}
hr {
background-color: black;
border: none;
height: 1px;
margin: 1em 0;
}
table {
margin: 1em 0;
border-collapse: collapse;
width: 100%;
overflow-x: auto;
display: block;
font-variant-numeric: lining-nums tabular-nums;
}
table caption {
margin-bottom: 0.75em;
}
tbody {
margin-top: 0.5em;
border-top: 1px solid black;
border-bottom: 1px solid black;
}
th {
border-top: 1px solid black;
padding: 0.25em 0.5em 0.25em 0.5em;
}
td {
padding: 0.125em 0.5em 0.25em 0.5em;
}
header {
margin-bottom: 4em;
text-align: center;
}
code{white-space: pre-wrap;}
span.smallcaps{font-variant: small-caps;}
span.underline{text-decoration: underline;}
div.column{display: inline-block; vertical-align: top; width: 50%;}
div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
ul.task-list{list-style: none;}
q { quotes: "„" "”" "»" "«"; }
.display.math{display: block; text-align: center; margin: 0.5rem auto;}
</style>
</head>
<body>
<p>Dear BIRD users,</p>
<p>we’re, as promised, releasing patch versions for all the supported
branches. Downloads are possible at <a
href="https://bird.nic.cz/get-bird/"
class="uri">https://bird.nic.cz/get-bird/</a> and in our upstream
repositories.</p>
<p>There are some security-relevant fixes this time with a varying
degree of relevance.</p>
<p>We have fixed a lot of BGP in BIRD 3, most notably several nasty bugs
in graceful restart behavior, labelled NLRI parsing and other MPLS
stuff. (There are still more MPLS bugs pending in BIRD 3.)</p>
<p>We have fixed several flowspec parser flaws in all versions, which
were there for years.</p>
<p>We have fixed the no-refeed bug of BMP in BIRD 3, and also a
cornercase off-by-one in all versions.</p>
<p>We have fixed a bunch of corner case OSPF bugs.</p>
<p>We have fixed a bunch of race conditions in internal reading the
routing tables.</p>
<p>We have also fixed the infamous remote code execution bug happening
when the path mask feature is used on a gargantuan AS Path (in all
versions).</p>
<p>There are some outstanding bugs (in all versions) reported, and we’ve
prioritized expediting this release which is already quite beefy, over
doing it all at once.</p>
<p>If your bug report has been reported as fixed, we would love if you
confirmed that from your side. If not, it will most probably get fixed
in the next patch release.</p>
<p>Officially supported versions are now:</p>
<ul>
<li>3.3.x and 2.19.x until 6 months after 3.4.0 and 2.20.0 get
released</li>
<li>3.2.x and 2.18.x until end of November 2026</li>
<li>LTS 3.1.x and 2.17.x tracking Debian Trixie</li>
</ul>
<p>Also, on commercial note, we offer BIRD Support, so that you can get
help with configuration, priority access to critical bug information and
fixes, and better influence the overall development directions. It’s the
users paying for these services, who keep the development running. More
on that at our website: <a
href="https://bird.nic.cz/commercial-services/"
class="uri">https://bird.nic.cz/commercial-services/</a></p>
<p>Happy routing! Maria and the BIRD Team</p>
<p>–<br />
Maria Matejka (she/her) | BIRD Team Leader | CZ.NIC, z.s.p.o.</p>
</body>
</html>