CVE-2026-92698

Full vulnerability record from the local CVENow database.

Description

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review.

Severity

HIGH

CVSS score

8.2 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-11-05 23:17:02.633000

Last modified

2026-11-05 23:17:02.777000

View original CVE JSON

{
  "id": "CVE-2026-92698",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-05T23:17:02.633",
  "lastModified": "2026-11-05T23:17:02.777",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "pavel-odintsov",
          "product": "fastnetmon",
          "versions": [
            {
              "version": "<= 1.2.9",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1089",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1093",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2",
      "source": "[email protected]"
    }
  ]
}