{"id":"CVE-2026-92693","kind":"vulnerability","aliases":["CVE-2026-92693"],"related":[],"title":"FastNetMon: crafted sFlow packet triggers out-of-bounds read remotely","description":"FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review.","summary":"FastNetMon, a DDoS detector, reads past the end of a packet buffer when parsing a crafted IPv6 fragment header inside sFlow v5 data. An unauthenticated remote sender can make the detector read memory it should not, which may leak or disrupt data.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fastnetmon","fixed":[],"affected":"<= 1.2.9","ecosystem":"github"}],"ecosystems":[],"tags":["ddos-detection","fastnetmon","network-monitoring","package","sflow"],"not_affected_if":["isolated-management-network","sflow-disabled"],"how_to_check":"- Run fastnetmon --version; 1.2.9 and earlier are affected, and no release is patched yet.\n- Check whether the sFlow collector is enabled in fastnetmon.conf and whether its UDP port is reachable from untrusted networks (firewall or ACL it to your routers only).\n- If you build from source, check that your tree includes commit 1da80df73620c6d0aa4462e9611e65047529b12a.\n- The advisory does not say whether the sFlow listener is on by default; check your config.","fix":"No patched release: the advisory lists patched versions as None (affected <= 1.2.9). The upstream commit 1da80df (2026-07-20) adds the missing bounds check; until a release ships, build from master at or after that commit, or keep the sFlow listener off untrusted networks.","status":"open","published_at":"2026-11-05T23:17:01+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","triaged_at":"2026-11-05T23:49:37+00:00","updated_at":"2026-11-05T23:51:33+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-05T23:49:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FastNetMon: crafted sFlow packet triggers out-of-bounds read remotely","impact":"medium","summary":"FastNetMon, a DDoS detector, reads past the end of a packet buffer when parsing a crafted IPv6 fragment header inside sFlow v5 data. An unauthenticated remote sender can make the detector read memory it should not, which may leak or disrupt data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["fastnetmon","sflow","network-monitoring","ddos-detection"],"confidence":0.7,"fix_status":"none","needs_auth":"no","worst_case":"Attacker triggers out-of-bounds memory reads in the detector process.","analyst_note":"Confirm whether the advisory states a fixed release and whether the sFlow listener is on by default; check the linked vendor advisory on github.com.","how_to_check":"- Check the installed FastNetMon version against the affected range: 1.2.9 and earlier.\n- Confirm whether the sFlow collector is exposed to untrusted networks (sFlow v5 RAW_PACKET_HEADER records are accepted).","plain_action":"","needs_analyst":true,"not_affected_if":["sflow-disabled","isolated-management-network"],"who_is_affected":"Any FastNetMon 1.2.9 or earlier deployment that receives sFlow v5 traffic from a network that can send packets to it. The shared packet parser is reached through sFlow RAW_PACKET_HEADER records, so a collector reachable from untrusted networks is the main exposure. Deployments that only receive sFlow from trusted routers on an isolated management network are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000751,"input_tokens":4387,"output_tokens":624,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether the advisory states a fixed release and whether the sFlow listener is on by default; check the linked vendor advisory on github.com.","search":"'-2026':13A,16A '-92693':14A,17A '1.2.9':82C 'addresssanit':151C 'advisori':154C 'avail':166C 'bound':9A,142C 'buffer':39B 'byte':112C,133C 'caus':135C 'craft':2A,43B,117C 'crash':161C 'cve':12A,15A 'data':50B,69B 'ddos':20B,30B,76C 'ddos-detect':19B 'derefer':94C 'detect':21B,147C 'detector':31B,58B,77C 'disrupt':68B 'earlier':84C 'eight':111C 'eight-byt':110C 'end':35B 'establish':157C 'extens':96C 'fastnetmon':1A,18A,22B,28B,70C 'first':106C 'fix':163C 'frag':102C 'fragment':45B,98C,113C,132C 'full':91C 'har':146C 'header':46B,97C,114C,122C 'high':74C 'high-perform':73C 'insid':47B 'ipprotocolnumberipv6':101C 'ipv6':44B,95C 'leak':66B 'make':56B 'may':65B 'memori':60B 'monitor':25B 'network':24B 'network-monitor':23B 'omit':134C 'out-of-bound':6A,139C 'packag':26B 'packet':4A,38B,87C,90C,121C 'pars':41B,85C 'parser':129C 'past':33B 'perform':75C 'present':104C 'process':160C 'product':159C 'raw':86C,120C 'reach':126C 'read':10A,32B,59B,143C,149C 'record':123C 'releas':164C 'remain':115C 'remot':11A,53B,125C,138C 'review':170C 'sender':54B 'sensor':79C 'sflow':3A,27B,48B,118C 'share':128C 'simpl':89C 'src/simple_packet_parser_ng.cpp':93C 'suppli':145C 'trigger':5A 'unauthent':52B,137C 'v5':49B,119C 'verifi':107C 'version':81C 'without':105C","nicknames":[],"mitigations":[],"who_affected":"Any FastNetMon 1.2.9 or earlier deployment that receives sFlow v5 traffic from a network that can send packets to it. The shared packet parser is reached through sFlow RAW_PACKET_HEADER records, so a collector reachable from untrusted networks is the main exposure. Deployments that only receive sFlow from trusted routers on an isolated management network are less exposed.","tier":"B","verified":{"fix":{"at":"2026-11-05T23:51:33Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a","run_id":1844},"products":{"at":"2026-11-05T23:51:33Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a","run_id":1844},"how_to_check":{"at":"2026-11-05T23:51:33Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a","run_id":1844}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fastnetmon"],"ptokens":["fastnetmon"],"labels":["ddosdetection","fastnetmon","high","networkmonitoring","package","sflow"],"campaign_type":null,"first_public_at":"2026-07-20T14:30:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92693","severity":null,"published_at":"2026-11-05T23:17:01+00:00","modified_at":"2026-11-05T23:17:02+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","fetched_at":"2026-11-05T23:48:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92693:1844","url":null,"severity":null,"published_at":"2026-11-05T23:51:33+00:00","modified_at":"2026-11-05T23:51:33+00:00","first_seen_at":"2026-11-05T23:51:33+00:00","fetched_at":"2026-11-05T23:51:33+00:00","note":"Read GHSA-jmjw-392h-4g93 and the fix commit. Patched versions None; fix on master only. Advisory shows ASan out-of-bounds read of 2 bytes in a harness, not a production crash; no exploitation reported. Default sFlow state not stated. X skipped (no search done)."}],"documents":[{"id":81503,"url":"https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81504,"url":"https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-20T14:30:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}