CVE-2026-93424

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93424", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-17T20:57:18.985Z", "datePublished": "2026-11-05T22:31:58.734Z", "dateUpdated": "2026-11-10T19:34:11.761Z"}, "containers": {"cna": {"title": "FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments", "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv"}, {"name": "https://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9", "tags": ["x_refsource_MISC"], "url": "https://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9"}], "affected": [{"vendor": "pavel-odintsov", "product": "fastnetmon", "versions": [{"version": "<= 1.2.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T22:31:58.734Z"}, "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review."}], "source": {"advisory": "GHSA-ph88-95vc-x6gv", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-10T19:33:41.834529Z", "id": "CVE-2026-93424", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T19:34:11.761Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-93424", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-09-17T20:57:18.985Z", "datePublished": "2026-11-05T22:31:58.734Z", "dateUpdated": "2026-11-10T19:34:11.761Z"}, "containers": {"cna": {"title": "FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments", "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "lang": "en", "description": "CWE-416: Use After Free", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv"}, {"name": "https://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9", "tags": ["x_refsource_MISC"], "url": "https://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9"}], "affected": [{"vendor": "pavel-odintsov", "product": "fastnetmon", "versions": [{"version": "<= 1.2.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T22:31:58.734Z"}, "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review."}], "source": {"advisory": "GHSA-ph88-95vc-x6gv", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-93424", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-10T19:33:41.834529Z"}}}], "references": [{"url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-10T19:33:57.693Z"}}]}}

{"affected": [{"affectedData": [{"product": "fastnetmon", "vendor": "pavel-odintsov", "versions": [{"status": "affected", "version": "<= 1.2.9"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review."}], "id": "CVE-2026-93424", "lastModified": "2026-11-10T20:19:46.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-93424", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-10T19:33:41.834529Z", "version": "2.0.3"}}]}, "published": "2026-11-05T23:17:02.817", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9"}, {"source": "security-advisories@github.com", "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "fastnetmon: FastNetMon: Denial of Service via race condition in NetFlow template processing", "id": "2567951", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567951"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in FastNetMon. An unauthenticated remote attacker with access to the NetFlow or IPFIX listening ports can trigger a race condition during concurrent template updates and traffic processing. This issue causes the application to access memory after it has been freed (a use-after-free condition), leading to an application crash and resulting in a Denial of Service (DoS)."], "mitigation": {"lang": "en:us", "value": "Restrict network access to the NetFlow and IPFIX collector ports to only trusted flow exporters, or configure FastNetMon to listen on a single port.\n1. Restrict incoming traffic on the collector UDP port using firewalld to authorized exporter IP addresses:\n```\nfirewall-cmd --permanent --zone=public --add-rich-rule='rule family=\"ipv4\" source address=\"<trusted_router_ip>\" port port=\"<collector_port>\" protocol=\"udp\" accept'\nfirewall-cmd --reload\n```\n2. Alternatively, adjust `/etc/fastnetmon.conf` to declare only a single listening port in `netflow_ports` rather than multiple ports, and restart the daemon:\n```\nsystemctl restart fastnetmon\n```\nCaveats: Limiting ingress packets to explicit IP addresses requires defining all flow-exporting network devices. Restricting the configuration to a single port may constrain environments relying on multi-port flow ingestion.\nWarning: Executing `firewall-cmd --reload` reloads active firewall rules. Restarting the service via `systemctl restart fastnetmon` will temporarily interrupt traffic flow processing."}, "name": "CVE-2026-93424", "public_date": "2026-11-05T22:31:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-93424\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-93424\nhttps://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9\nhttps://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv"], "statement": "This vulnerability is rated as Important severity because unauthenticated remote attackers capable of reaching the collector listener ports can crash the monitoring service without requiring privileges, disrupting denial-of-service detection across the network. In typical Red Hat Enterprise Linux environments, FastNetMon is not included in standard package repositories and monitoring collectors are intended to reside on restricted management segments. The issue is further constrained to configurations defining multiple listening ports where parallel flow processing can trigger memory corruption. Neither data integrity nor system confidentiality is compromised, as the flaw exclusively causes daemon termination.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.9]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "fastnetmon", "source": "cna", "vendor": "pavel-odintsov"}, "product": "fastnetmon", "vendor": "pavel-odintsov"}], "created": "2026-11-05T23:45:07.419085+00:00", "updated": "2026-11-06T15:00:07.992124+00:00", "vendors": ["pavel-odintsov", "pavel-odintsov$PRODUCT$fastnetmon"]}