Out-of-bounds read in FastNetMon sFlow parser enables remote crash
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
FastNetMon 1.2.9 and earlier trusts a header size field from sFlow packets as the captured length without checking it against the received data. This missing bounds check (CWE-125) lets the parser read past the end of the received UDP buffer. An unauthenticated remote attacker can crash the process and may read limited adjacent bytes through parsed flow fields.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pavel-odintsov | fastnetmon | up to 1.2.9 | — | No fix listed | CNA |
- fastnetmon Vendorpavel-odintsov Affected up to 1.2.9 Fixed in — No fix listed CNA
Remediation
The sources list no fixed version for FastNetMon.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Vendor assessments
Timeline
- 2026-11-05 Threatist record created from CVE-2026-92698
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
- 2026-11-07 Priority changed: MEDIUM → LOW
References
Other 5
- https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2
- https://github.com/pavel-odintsov/fastnetmon/pull/1089
- https://github.com/pavel-odintsov/fastnetmon/pull/1093
- https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533
- https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83
More pavel-odintsov vulnerabilities
- TI-2026-85701 Out-of-bounds read in FastNetMon shared IPv6 packet parser CVSS 3.1HIGH 8.2
- TI-2026-35974 FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer… CVSS 3.1CRITICAL 9.8
- TI-2026-35971 FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the… CVSS 3.1CRITICAL 9.8
- TI-2026-35976 FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP… CVSS 3.1CRITICAL 9.8
- TI-2026-35972 FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability… CVSS 3.1CRITICAL 9.8
- TI-2024-37109 An issue was discovered in FastNetMon Community Edition through 1.2.7. CVSS 3.1HIGH 7.5
Sources
- CVE-2026-92698 · CVE Program
- CVE-2026-92698 · NVD
- FIRST EPSS
- CVE-2026-92698 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences