CVE-2026-92698

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92698", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-16T16:22:31.541Z", "datePublished": "2026-11-05T22:35:58.969Z", "dateUpdated": "2026-11-09T17:40:59.330Z"}, "containers": {"cna": {"title": "FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2"}, {"name": "https://github.com/pavel-odintsov/fastnetmon/pull/1089", "tags": ["x_refsource_MISC"], "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1089"}, {"name": "https://github.com/pavel-odintsov/fastnetmon/pull/1093", "tags": ["x_refsource_MISC"], "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1093"}, {"name": "https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533", "tags": ["x_refsource_MISC"], "url": "https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533"}, {"name": "https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83", "tags": ["x_refsource_MISC"], "url": "https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83"}], "affected": [{"vendor": "pavel-odintsov", "product": "fastnetmon", "versions": [{"version": "<= 1.2.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T22:35:58.969Z"}, "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review."}], "source": {"advisory": "GHSA-852r-3wcv-pjx2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T17:38:52.729611Z", "id": "CVE-2026-92698", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:40:59.330Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92698", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T17:38:52.729611Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T17:38:54.227Z"}}], "cna": {"title": "FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read", "source": {"advisory": "GHSA-852r-3wcv-pjx2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "pavel-odintsov", "product": "fastnetmon", "versions": [{"status": "affected", "version": "<= 1.2.9"}]}], "references": [{"url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2", "name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pavel-odintsov/fastnetmon/pull/1089", "name": "https://github.com/pavel-odintsov/fastnetmon/pull/1089", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pavel-odintsov/fastnetmon/pull/1093", "name": "https://github.com/pavel-odintsov/fastnetmon/pull/1093", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533", "name": "https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83", "name": "https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T22:35:58.969Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92698", "state": "PUBLISHED", "dateUpdated": "2026-11-09T17:40:59.330Z", "dateReserved": "2026-09-16T16:22:31.541Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-11-05T22:35:58.969Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "fastnetmon", "vendor": "pavel-odintsov", "versions": [{"status": "affected", "version": "<= 1.2.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review."}], "id": "CVE-2026-92698", "lastModified": "2026-11-09T18:17:35.257", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92698", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T17:38:52.729611Z", "version": "2.0.3"}}]}, "published": "2026-11-05T23:17:02.633", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533"}, {"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83"}, {"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1089"}, {"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1093"}, {"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "fastnetmon: fastnetmon: Denial of Service via crafted sFlow packet", "id": "2567950", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567950"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["A flaw was found in FastNetMon. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted sFlow packet with an inflated header size. Because the application fails to properly validate the header length against the received packet buffer, processing the packet results in an out-of-bounds memory read. This can lead to a Denial of Service (DoS) by causing the process to crash, as well as potential limited information disclosure of adjacent memory contents."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network exposure of the sFlow collector port (default UDP port 6343) or disable the sFlow plugin if it is not required:\n1. Restrict incoming sFlow traffic to trusted network flow exporter IP addresses using firewalld:\n```\nfirewall-cmd --permanent --zone=public --remove-port=6343/udp\nfirewall-cmd --permanent --add-rich-rule='rule family=\"ipv4\" source address=\"<TRUSTED_EXPORTER_IP>\" port port=\"6343\" protocol=\"udp\" accept'\nfirewall-cmd --reload\n```\n2. Alternatively, if sFlow collection is not utilized by your deployment (e.g., using NetFlow or raw packet capture), disable sFlow processing in `/etc/fastnetmon.conf`:\n```\nsflow = off\n```\nAfter editing the configuration, restart the daemon:\n```\nsystemctl restart fastnetmon\n```\nWarning: Restarting FastNetMon or reloading the firewall will briefly interrupt flow metrics collection and traffic monitoring. Disabling sFlow will halt all ingestion of sFlow telemetry."}, "name": "CVE-2026-92698", "public_date": "2026-11-05T22:35:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92698\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92698\nhttps://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533\nhttps://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83\nhttps://github.com/pavel-odintsov/fastnetmon/pull/1089\nhttps://github.com/pavel-odintsov/fastnetmon/pull/1093\nhttps://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2"], "statement": "Red Hat Product Security rates this vulnerability as Important severity because an unauthenticated remote attacker can trigger a denial of service or disclose adjacent process memory without requiring prior privileges or user interaction. Successful exploitation causes FastNetMon to terminate abnormally, disrupting real-time network anomaly detection and DDoS monitoring across the infrastructure. This flaw specifically affects deployments where the sFlow collector plugin is enabled and reachable from untrusted network segments.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.9]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fastnetmon", "source": "cna", "vendor": "pavel-odintsov"}, "product": "fastnetmon", "vendor": "pavel-odintsov"}], "created": "2026-11-05T23:45:07.418429+00:00", "updated": "2026-11-05T23:45:07.697907+00:00", "vendors": ["pavel-odintsov", "pavel-odintsov$PRODUCT$fastnetmon"]}