Read the docs
TI-2026-85702 Aliases CVE-2026-92694

Race condition in FastNetMon IPv6 host counters map access

Priority LOW 26CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

FastNetMon through 1.2.9 iterates its IPv6 host counter map in draw_table_ipv6() without holding counter_map_mutex, while recalculate_speed() inserts new keys and may rehash the same map. This missing synchronization (CWE-362) causes undefined behavior under load, and a process crash is plausible but was not observed. The race only occurs when networks_list includes the targeted IPv6 range, and a remote unauthenticated attacker facing high attack complexity could trigger it, though reliable denial of service has not been established.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, FastNetMon's IPv6 top-talkers screen-draw thread in draw_table_ipv6() in src/fastnetmon_logic.cpp iterates ipv6_host_counters.average_speed_map without holding counter_map_mutex while recalculate_speed() inserts new keys and may rehash the same map. The race requires networks_list to include the targeted IPv6 range. It causes confirmed undefined behavior under load; a process crash is plausible but was not observed, so reliable denial of service has not been established. No fixed release is available as of this review.

Why it matters now

EPSS 0.00247 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
pavel-odintsovfastnetmonup to 1.2.9—No fix listedCNA
  • fastnetmon Vendorpavel-odintsov Affected up to 1.2.9 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for FastNetMon.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-92694
  2. 2026-11-06 Affected versions changed · Red Hat
  3. 2026-11-06 CVSS score added · Red Hat
  4. 2026-11-07 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2026-85701 Out-of-bounds read in FastNetMon shared IPv6 packet parser CVSS 3.1HIGH 8.2
  • TI-2026-35974 FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer… CVSS 3.1CRITICAL 9.8
  • TI-2026-35971 FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the… CVSS 3.1CRITICAL 9.8
  • TI-2026-35976 FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP… CVSS 3.1CRITICAL 9.8
  • TI-2026-35972 FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2024-37109 An issue was discovered in FastNetMon Community Edition through 1.2.7. CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences