{"id":"CVE-2026-122130","kind":"vulnerability","aliases":["CVE-2026-122130"],"related":[],"title":"ipfixcol2: integer overflow in Forwarder plugin enables heap overflow","description":"CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.","summary":"CESNET ipfixcol2 before 2.9.0 has an integer overflow in its Forwarder output plugin, where uint16_t length counters wrap. An unauthenticated IPFIX exporter can overflow a heap buffer, crashing the collector and possibly writing attacker-chosen 2-byte values to memory.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ipfix","ipfixcol2","linux","network-monitoring","package"],"not_affected_if":["no-forwarder-plugin","version-2.9.0-or-later"],"how_to_check":"- Check the installed ipfixcol2 version, for example with `ipfixcol2 --version` or the package manager, and confirm whether it is below `2.9.0`.\n- Look for a Forwarder output plugin in the collector configuration that forwards over TCP.","fix":"- Upgrade ipfixcol2 to `2.9.0` or later.","status":"open","published_at":"2026-11-04T21:18:08+00:00","first_seen_at":"2026-11-04T21:49:19+00:00","triaged_at":"2026-11-04T21:50:43+00:00","updated_at":"2026-11-04T21:50:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T21:50:43Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade ipfixcol2 to `2.9.0` or later.","reach":"network","title":"ipfixcol2: integer overflow in Forwarder plugin enables heap overflow","impact":"high","summary":"CESNET ipfixcol2 before 2.9.0 has an integer overflow in its Forwarder output plugin, where uint16_t length counters wrap. An unauthenticated IPFIX exporter can overflow a heap buffer, crashing the collector and possibly writing attacker-chosen 2-byte values to memory.","audience":"developers","category":"package","nicknames":[],"who_cares":["ipfixcol2","ipfix","network-monitoring","linux"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Collector crashes and attacker may write attacker-chosen values to memory","analyst_note":"","how_to_check":"- Check the installed ipfixcol2 version, for example with `ipfixcol2 --version` or the package manager, and confirm whether it is below `2.9.0`.\n- Look for a Forwarder output plugin in the collector configuration that forwards over TCP.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2.9.0-or-later","no-forwarder-plugin"],"who_is_affected":"Teams running the ipfixcol2 collector with the Forwarder output plugin, which forwards IPFIX data over TCP. The collector accepts data from IPFIX exporters without authentication, so any reachable exporter port is a path in. Installations that do not use the Forwarder plugin or that are on 2.9.0 or later are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4237,"output_tokens":608,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-122130':12A,15A '-2026':11A,14A '-65535':101C '2':60B,119C '2.3.0':67C '2.9.0':26B,69C 'address':126C 'allow':81C 'attack':58B,97C,124C 'attacker-chosen':57B 'attacker-influenc':123C 'buffer':50B,89C 'byte':61B,102C,120C 'cesnet':23B,65C 'chosen':59B 'collector':53B,110C 'contain':70C 'counter':40B,96C 'crash':51B,115C 'cve':10A,13A 'data':103C 'enabl':7A 'export':45B,84C 'forward':5A,33B,77C,111C 'heap':8A,49B,88C 'influenc':125C 'integ':2A,29B,72C 'ipfix':16B,44B,83C 'ipfixcol2':1A,17B,24B,66C 'larg':106C 'length':39B,95C 'linux':18B 'memori':64B 'messag':94C 'monitor':21B 'near':100C 'network':20B 'network-monitor':19B 'output':34B,78C 'overflow':3A,9A,30B,47B,73C,86C 'packag':22B 'perform':118C 'plugin':6A,35B,79C 'possibl':55B 'send':99C 'set':104C 'tcp':113C 'templat':107C 'uint16':37B,92C 'unauthent':43B,82C 'valu':62B 'vulner':74C 'wrap':41B,91C 'write':56B,121C","nicknames":[],"mitigations":[],"who_affected":"Teams running the ipfixcol2 collector with the Forwarder output plugin, which forwards IPFIX data over TCP. The collector accepts data from IPFIX exporters without authentication, so any reachable exporter port is a path in. Installations that do not use the Forwarder plugin or that are on 2.9.0 or later are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","ipfix","ipfixcol2","linux","networkmonitoring","package"],"campaign_type":null,"first_public_at":"2026-11-04T21:18:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-122130","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-122130","severity":null,"published_at":"2026-11-04T21:18:08+00:00","modified_at":"2026-11-04T21:18:08+00:00","first_seen_at":"2026-11-04T21:49:19+00:00","fetched_at":"2026-11-04T21:49:19+00:00","note":null}],"documents":[{"id":70649,"url":"https://github.com/CESNET/ipfixcol2/commit/ad206f6217257b06b139f1b2bce50d52f5bc6acb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":70643,"url":"https://github.com/CESNET/ipfixcol2/releases/tag/v2.9.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":70651,"url":"https://www.vulncheck.com/advisories/cesnet-ipfixcol2-2.3.0-before-2.9.0-buffer-overflow-via-forwarder-output-plugin","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}