FASTNETMON · CVE-2026-92693 · Package
NO FIX YET · SEE WHAT TO DO
FastNetMon, a DDoS detector, reads past the end of a packet buffer when parsing a crafted IPv6 fragment header inside sFlow v5 data. An unauthenticated remote sender can make the detector read memory it should not, which may leak or disrupt data.
first public Jul 20, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Any FastNetMon 1.2.9 or earlier deployment that receives sFlow v5 traffic from a network that can send packets to it. The shared packet parser is reached through sFlow RAW_PACKET_HEADER records, so a collector reachable from untrusted networks is the main exposure. Deployments that only receive sFlow from trusted routers on an isolated management network are less exposed.
Not affected if isolated-management-network, sflow-disabled
Who cares ddos-detection, fastnetmon, network-monitoring, sflow
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.2.9)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.