CVE-2026-92697

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92697", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-16T16:22:31.541Z", "datePublished": "2026-11-05T22:34:52.385Z", "dateUpdated": "2026-11-10T04:46:16.661Z"}, "containers": {"cna": {"title": "FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2"}, {"name": "https://github.com/pavel-odintsov/fastnetmon/pull/1088", "tags": ["x_refsource_MISC"], "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1088"}, {"name": "https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb", "tags": ["x_refsource_MISC"], "url": "https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb"}], "affected": [{"vendor": "pavel-odintsov", "product": "fastnetmon", "versions": [{"version": "<= 1.2.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T22:34:52.385Z"}, "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls \u00a0strlen()\u00a0 on an attacker-controlled interface-description field without bounding the scan to the field\u2019s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review."}], "source": {"advisory": "GHSA-ff5f-p5jw-8fq2", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T04:45:24.025310Z", "id": "CVE-2026-92697", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T04:46:16.661Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92697", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T04:45:24.025310Z"}}}], "references": [{"url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T04:45:42.508Z"}}], "cna": {"title": "FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read", "source": {"advisory": "GHSA-ff5f-p5jw-8fq2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "pavel-odintsov", "product": "fastnetmon", "versions": [{"status": "affected", "version": "<= 1.2.9"}]}], "references": [{"url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2", "name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pavel-odintsov/fastnetmon/pull/1088", "name": "https://github.com/pavel-odintsov/fastnetmon/pull/1088", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb", "name": "https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls \u00a0strlen()\u00a0 on an attacker-controlled interface-description field without bounding the scan to the field\u2019s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T22:34:52.385Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92697", "state": "PUBLISHED", "dateUpdated": "2026-11-10T04:46:16.661Z", "dateReserved": "2026-09-16T16:22:31.541Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T22:34:52.385Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fastnetmon", "vendor": "pavel-odintsov", "versions": [{"status": "affected", "version": "<= 1.2.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls \u00a0strlen()\u00a0 on an attacker-controlled interface-description field without bounding the scan to the field\u2019s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review."}], "id": "CVE-2026-92697", "lastModified": "2026-11-10T05:18:16.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92697", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T04:45:24.025310Z", "version": "2.0.3"}}]}, "published": "2026-11-05T23:17:02.460", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb"}, {"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1088"}, {"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "fastnetmon: fastnetmon: Denial of Service via crafted NetFlow packets", "id": "2567967", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567967"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in FastNetMon. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by crashing the service. By sending specially crafted network packets containing unterminated data fields to the NetFlow collector, an attacker can trigger an out-of-bounds read error that abruptly terminates the monitoring process."], "mitigation": {"lang": "en:us", "value": "Restrict network exposure so only trusted network devices (such as designated flow-exporting routers and switches) can reach the NetFlow collector port, or disable the daemon if flow monitoring is not needed.\n1. Restrict the NetFlow UDP port (default 2055) to trusted sources using firewalld:\n```\nfirewall-cmd --permanent --zone=trusted --add-source=<ROUTER_IP>/32\nfirewall-cmd --permanent --zone=trusted --add-port=2055/udp\nfirewall-cmd --reload\n```\n2. Alternatively, disable the service entirely if NetFlow processing is not required:\n```\nsystemctl stop fastnetmon\nsystemctl disable fastnetmon\n```\nCaveats:\nRestricting UDP traffic mitigates untrusted external exploitation, but any flow exporter within the allowed IP range could still trigger the flaw if compromised or misconfigured. Stopping the daemon halts DDoS traffic detection and flow collection completely.\nWarning: Modifying firewall rules requires reloading the firewalld configuration (`firewall-cmd --reload`), which immediately alters active packet filtering rules. Stopping the daemon interrupts active monitoring services."}, "name": "CVE-2026-92697", "public_date": "2026-11-05T22:34:52Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92697\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92697\nhttps://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb\nhttps://github.com/pavel-odintsov/fastnetmon/pull/1088\nhttps://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2"], "statement": "Red Hat rates this vulnerability as Important because an unauthenticated remote attacker can abruptly terminate the monitoring daemon without credentials, leading to a complete service disruption. This risk warrants an Important severity rating because disabling the network sensor blinds administrators to traffic anomalies and denial-of-service conditions, despite the flaw not facilitating code execution or data exposure. Impact is greatest in environments where the NetFlow collector port is exposed to wider network segments rather than restricted to authorized flow-exporting devices.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.9]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fastnetmon", "source": "cna", "vendor": "pavel-odintsov"}, "product": "fastnetmon", "vendor": "pavel-odintsov"}], "created": "2026-11-05T23:45:07.418715+00:00", "updated": "2026-11-06T15:00:07.991460+00:00", "vendors": ["pavel-odintsov", "pavel-odintsov$PRODUCT$fastnetmon"]}