CVE-2026-122130 · Package
NO FIX YET · SEE WHAT TO DO
CESNET ipfixcol2 before 2.9.0 has an integer overflow in its Forwarder output plugin, where uint16_t length counters wrap. An unauthenticated IPFIX exporter can overflow a heap buffer, crashing the collector and possibly writing attacker-chosen 2-byte values to memory.
first public Nov 4, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running the ipfixcol2 collector with the Forwarder output plugin, which forwards IPFIX data over TCP. The collector accepts data from IPFIX exporters without authentication, so any reachable exporter port is a path in. Installations that do not use the Forwarder plugin or that are on 2.9.0 or later are not affected by this flaw.
Not affected if no-forwarder-plugin, version-2.9.0-or-later
Who cares ipfix, ipfixcol2, linux, network-monitoring
ipfixcol2 --version or the package manager, and confirm whether it is below 2.9.0.2.9.0 or later.CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.