CVE-2026-122127 · Package
NO FIX YET · SEE WHAT TO DO
ipfixcol2 is a flow-data collector whose LZ4 decoder writes past a heap buffer when a crafted packet declares a small ring buffer size and a large decompressed size. An unauthenticated network peer can write up to 65535 controlled bytes and crash the collector.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run the ipfixcol2 collector (version 2.7.1 up to but not including 2.9.0) to receive IPFIX flow records over the network. Exposure depends on whether the collector accepts LZ4-compressed input from peers that can reach it; collectors on isolated networks with no reachable listener are lower risk. unknown whether other ipfixcol2 versions outside that range are affected.
Not affected if no-network-listener, version-2.9.0-or-later
Who cares ipfixcol2, netflow-collectors, self-hosted
ipfixcol2 --version or the package manager, and see whether it is below 2.9.02.9.0 (fixed version; sources state versions before 2.9.0 are affected)CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled bytes and crash the collector.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.