Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-92698 (GCVE-0-2026-92698)

Vulnerability from cvelistv5 – Published: 2026-11-05 22:35 – Updated: 2026-11-09 17:40

Title

FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read

Summary

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 17:38 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA

References

5 references

URL	Tags
https://github.com/pavel-odintsov/fastnetmon/secu…	x_refsource_CONFIRM
https://github.com/pavel-odintsov/fastnetmon/pull/1089	x_refsource_MISC
https://github.com/pavel-odintsov/fastnetmon/pull/1093	x_refsource_MISC
https://github.com/pavel-odintsov/fastnetmon/comm…	x_refsource_MISC
https://github.com/pavel-odintsov/fastnetmon/comm…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pavel-odintsov	fastnetmon	Affected: <= 1.2.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92698",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T17:38:52.729611Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T17:40:59.330Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fastnetmon",
          "vendor": "pavel-odintsov",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.2.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser\u0027s bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T22:35:58.969Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2"
        },
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/pull/1089",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1089"
        },
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/pull/1093",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1093"
        },
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533"
        },
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83"
        }
      ],
      "source": {
        "advisory": "GHSA-852r-3wcv-pjx2",
        "discovery": "UNKNOWN"
      },
      "title": "FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-92698",
    "datePublished": "2026-11-05T22:35:58.969Z",
    "dateReserved": "2026-09-16T16:22:31.541Z",
    "dateUpdated": "2026-11-09T17:40:59.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92697 (GCVE-0-2026-92697)

Vulnerability from cvelistv5 – Published: 2026-11-05 22:34 – Updated: 2026-11-10 04:46

Title

FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read

Summary

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls strlen() on an attacker-controlled interface-description field without bounding the scan to the field’s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-10 04:45 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA

References

3 references

URL	Tags
https://github.com/pavel-odintsov/fastnetmon/secu…	x_refsource_CONFIRM
https://github.com/pavel-odintsov/fastnetmon/pull/1088	x_refsource_MISC
https://github.com/pavel-odintsov/fastnetmon/comm…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pavel-odintsov	fastnetmon	Affected: <= 1.2.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92697",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-10T04:45:24.025310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-10T04:46:16.661Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fastnetmon",
          "vendor": "pavel-odintsov",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.2.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls \u00a0strlen()\u00a0 on an attacker-controlled interface-description field without bounding the scan to the field\u2019s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T22:34:52.385Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2"
        },
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/pull/1088",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1088"
        },
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb"
        }
      ],
      "source": {
        "advisory": "GHSA-ff5f-p5jw-8fq2",
        "discovery": "UNKNOWN"
      },
      "title": "FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-92697",
    "datePublished": "2026-11-05T22:34:52.385Z",
    "dateReserved": "2026-09-16T16:22:31.541Z",
    "dateUpdated": "2026-11-10T04:46:16.661Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92693 (GCVE-0-2026-92693)

Vulnerability from cvelistv5 – Published: 2026-11-05 22:32 – Updated: 2026-11-06 17:42

Title

FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser

Summary

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-06 17:41 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA

References

2 references

URL	Tags
https://github.com/pavel-odintsov/fastnetmon/secu…	x_refsource_CONFIRM
https://github.com/pavel-odintsov/fastnetmon/comm…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pavel-odintsov	fastnetmon	Affected: <= 1.2.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92693",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-06T17:41:42.515620Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-06T17:42:09.687Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fastnetmon",
          "vendor": "pavel-odintsov",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.2.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T22:32:35.388Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93"
        },
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a"
        }
      ],
      "source": {
        "advisory": "GHSA-jmjw-392h-4g93",
        "discovery": "UNKNOWN"
      },
      "title": "FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-92693",
    "datePublished": "2026-11-05T22:32:35.388Z",
    "dateReserved": "2026-09-16T16:22:31.540Z",
    "dateUpdated": "2026-11-06T17:42:09.687Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93424 (GCVE-0-2026-93424)

Vulnerability from cvelistv5 – Published: 2026-11-05 22:31 – Updated: 2026-11-05 22:31

Title

FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments

Summary

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-416 - Use After Free

Assigner

GitHub_M CNA

References

2 references

URL	Tags
https://github.com/pavel-odintsov/fastnetmon/secu…	x_refsource_CONFIRM
https://github.com/pavel-odintsov/fastnetmon/comm…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pavel-odintsov	fastnetmon	Affected: <= 1.2.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "fastnetmon",
          "vendor": "pavel-odintsov",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.2.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T22:31:58.734Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv"
        },
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9"
        }
      ],
      "source": {
        "advisory": "GHSA-ph88-95vc-x6gv",
        "discovery": "UNKNOWN"
      },
      "title": "FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-93424",
    "datePublished": "2026-11-05T22:31:58.734Z",
    "dateReserved": "2026-09-17T20:57:18.985Z",
    "dateUpdated": "2026-11-05T22:31:58.734Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92695 (GCVE-0-2026-92695)

Vulnerability from cvelistv5 – Published: 2026-11-05 22:30 – Updated: 2026-11-05 22:30

Title

FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated frames

Summary

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the live parse_packet() callback in src/pcap_plugin/pcap_collector.cpp is registered through pcap_loop and processes captured frames when pcap = on without checking packethdr->caplen. A short frame or an attacker-controlled IPv4 header length can make the parser dereference IP or transport headers beyond the captured bytes, causing an out-of-bounds read and process termination. No fixed release is available as of this review.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

CWE

CWE-125 - Out-of-bounds Read

Assigner

GitHub_M CNA

References

2 references

URL	Tags
https://github.com/pavel-odintsov/fastnetmon/secu…	x_refsource_CONFIRM
https://github.com/pavel-odintsov/fastnetmon/comm…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pavel-odintsov	fastnetmon	Affected: <= 1.2.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "fastnetmon",
          "vendor": "pavel-odintsov",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.2.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the live parse_packet() callback in src/pcap_plugin/pcap_collector.cpp is registered through pcap_loop and processes captured frames when pcap = on without checking packethdr-\u003ecaplen. A short frame or an attacker-controlled IPv4 header length can make the parser dereference IP or transport headers beyond the captured bytes, causing an out-of-bounds read and process termination. No fixed release is available as of this review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "CWE-125: Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T22:30:59.204Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-c27c-943r-vr8h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-c27c-943r-vr8h"
        },
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/commit/5d0ee2d25fddb2db746ce4ce3326a589a2afef40",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/commit/5d0ee2d25fddb2db746ce4ce3326a589a2afef40"
        }
      ],
      "source": {
        "advisory": "GHSA-c27c-943r-vr8h",
        "discovery": "UNKNOWN"
      },
      "title": "FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated frames"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-92695",
    "datePublished": "2026-11-05T22:30:59.204Z",
    "dateReserved": "2026-09-16T16:22:31.541Z",
    "dateUpdated": "2026-11-05T22:30:59.204Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-92694 (GCVE-0-2026-92694)

Vulnerability from cvelistv5 – Published: 2026-11-05 22:29 – Updated: 2026-11-09 17:41

Title

FastNetMon: IPv6 host counters map iterated without lock, racing concurrent inserts

Summary

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, FastNetMon's IPv6 top-talkers screen-draw thread in draw_table_ipv6() in src/fastnetmon_logic.cpp iterates ipv6_host_counters.average_speed_map without holding counter_map_mutex while recalculate_speed() inserts new keys and may rehash the same map. The race requires networks_list to include the targeted IPv6 range. It causes confirmed undefined behavior under load; a process crash is plausible but was not observed, so reliable denial of service has not been established. No fixed release is available as of this review.

Severity

5.9 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-09 17:36 UTC

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Assigner

GitHub_M CNA

References

3 references

URL	Tags
https://github.com/pavel-odintsov/fastnetmon/secu…	x_refsource_CONFIRM
https://github.com/pavel-odintsov/fastnetmon/pull/1087	x_refsource_MISC
https://github.com/pavel-odintsov/fastnetmon/comm…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
pavel-odintsov	fastnetmon	Affected: <= 1.2.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-92694",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-09T17:36:16.826474Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-09T17:41:09.393Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "fastnetmon",
          "vendor": "pavel-odintsov",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 1.2.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, FastNetMon\u0027s IPv6 top-talkers screen-draw thread in draw_table_ipv6() in src/fastnetmon_logic.cpp iterates ipv6_host_counters.average_speed_map without holding counter_map_mutex while recalculate_speed() inserts new keys and may rehash the same map. The race requires networks_list to include the targeted IPv6 range. It causes confirmed undefined behavior under load; a process crash is plausible but was not observed, so reliable denial of service has not been established. No fixed release is available as of this review."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T22:29:26.943Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-phrw-2q76-5m7h",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-phrw-2q76-5m7h"
        },
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/pull/1087",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1087"
        },
        {
          "name": "https://github.com/pavel-odintsov/fastnetmon/commit/1294724ea931dc78fe545360f2193398bba35381",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pavel-odintsov/fastnetmon/commit/1294724ea931dc78fe545360f2193398bba35381"
        }
      ],
      "source": {
        "advisory": "GHSA-phrw-2q76-5m7h",
        "discovery": "UNKNOWN"
      },
      "title": "FastNetMon: IPv6 host counters map iterated without lock, racing concurrent inserts"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-92694",
    "datePublished": "2026-11-05T22:29:26.943Z",
    "dateReserved": "2026-09-16T16:22:31.541Z",
    "dateUpdated": "2026-11-09T17:41:09.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

6 vulnerabilities by pavel-odintsov

CVE-2026-92698 (GCVE-0-2026-92698)

CVE-2026-92697 (GCVE-0-2026-92697)

CVE-2026-92693 (GCVE-0-2026-92693)

CVE-2026-93424 (GCVE-0-2026-93424)

CVE-2026-92695 (GCVE-0-2026-92695)

CVE-2026-92694 (GCVE-0-2026-92694)