CVE-2026-122129 · Other
NO FIX YET · SEE WHAT TO DO
CESNET ipfixcol2 before 2.9.0 is an IPFIX flow collector whose LZ4 decoder trusts a declared ring buffer size from the start header. An unauthenticated attacker who opens TCP connections with very large sizes can force up to 4 GiB of allocation per connection and deny collector service.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running ipfixcol2 as a network flow collector that accepts TCP input with LZ4 compression can be hit remotely without credentials. Collectors that only read files, or that listen on UDP or are behind a firewall limiting who can connect, have less exposure. unknown whether a non-LZ4 configuration is affected.
Not affected if file-input-only, firewalled-collector, no-tcp-listener
Who cares ipfixcol2, linux, network-monitoring
ipfixcol2 --version or the package manager, and see whether it is below 2.9.0.2.9.0 or laterCESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.