CVE-2026-92693

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92693", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-16T16:22:31.540Z", "datePublished": "2026-11-05T22:32:35.388Z", "dateUpdated": "2026-11-06T17:42:09.687Z"}, "containers": {"cna": {"title": "FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93"}, {"name": "https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a", "tags": ["x_refsource_MISC"], "url": "https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a"}], "affected": [{"vendor": "pavel-odintsov", "product": "fastnetmon", "versions": [{"version": "<= 1.2.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T22:32:35.388Z"}, "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review."}], "source": {"advisory": "GHSA-jmjw-392h-4g93", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-06T17:41:42.515620Z", "id": "CVE-2026-92693", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:42:09.687Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92693", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T17:41:42.515620Z"}}}], "references": [{"url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-06T17:42:02.233Z"}}], "cna": {"title": "FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser", "source": {"advisory": "GHSA-jmjw-392h-4g93", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "pavel-odintsov", "product": "fastnetmon", "versions": [{"status": "affected", "version": "<= 1.2.9"}]}], "references": [{"url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93", "name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a", "name": "https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T22:32:35.388Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92693", "state": "PUBLISHED", "dateUpdated": "2026-11-06T17:42:09.687Z", "dateReserved": "2026-09-16T16:22:31.540Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T22:32:35.388Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fastnetmon", "vendor": "pavel-odintsov", "versions": [{"status": "affected", "version": "<= 1.2.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review."}], "id": "CVE-2026-92693", "lastModified": "2026-11-06T18:18:24.003", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92693", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-06T17:41:42.515620Z", "version": "2.0.3"}}]}, "published": "2026-11-05T23:17:01.923", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a"}, {"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "fastnetmon: FastNetMon: Denial of Service via crafted IPv6 packet header", "id": "2567956", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567956"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in FastNetMon. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) or potentially disclose memory contents. By sending a crafted network packet record containing a truncated IPv6 fragment header, an attacker triggers an out-of-bounds memory read because the packet parser fails to verify that the required header bytes are present."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-92693", "public_date": "2026-11-05T22:32:35Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92693\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92693\nhttps://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a\nhttps://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93"], "statement": "This vulnerability is rated as an Important severity because an unauthenticated remote attacker can trigger a denial of service by transmitting crafted network packets, leading to an out-of-bounds memory read and service crash without requiring authentication or user interaction. FastNetMon is not shipped or supported in Red Hat Enterprise Linux or any other Red Hat product lines, meaning default installations are unaffected. For standalone deployments on Red Hat platforms, exposure is restricted to systems actively processing sampled packet telemetry from untrusted networks.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.9]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fastnetmon", "source": "cna", "vendor": "pavel-odintsov"}, "product": "fastnetmon", "vendor": "pavel-odintsov"}], "created": "2026-11-05T23:45:07.418905+00:00", "updated": "2026-11-05T23:45:07.698226+00:00", "vendors": ["pavel-odintsov", "pavel-odintsov$PRODUCT$fastnetmon"]}