{"id":"CVE-2026-92694","kind":"vulnerability","aliases":["CVE-2026-92694"],"related":[],"title":"FastNetMon: IPv6 top-talkers display race can crash the detector","description":"FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, FastNetMon's IPv6 top-talkers screen-draw thread in draw_table_ipv6() in src/fastnetmon_logic.cpp iterates ipv6_host_counters.average_speed_map without holding counter_map_mutex while recalculate_speed() inserts new keys and may rehash the same map. The race requires networks_list to include the targeted IPv6 range. It causes confirmed undefined behavior under load; a process crash is plausible but was not observed, so reliable denial of service has not been established. No fixed release is available as of this review.","summary":"FastNetMon's IPv6 top-talkers screen thread reads a shared map without its lock while another thread inserts into it, causing undefined behavior under load. A crash is plausible, but a reliable denial of service has not been shown.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ddos-detection","fastnetmon","ipv6","other"],"not_affected_if":["newer-version","no-ipv6-networks"],"how_to_check":"- Check the installed version with the FastNetMon binary or package manager; versions `1.2.9` and earlier are affected.\n- Check whether `networks_list` includes any IPv6 range, since the race needs one to be monitored.","fix":null,"status":"open","published_at":"2026-11-05T23:17:02+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","triaged_at":"2026-11-05T23:49:45+00:00","updated_at":"2026-11-05T23:49:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-05T23:49:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FastNetMon: IPv6 top-talkers display race can crash the detector","impact":"low","summary":"FastNetMon's IPv6 top-talkers screen thread reads a shared map without its lock while another thread inserts into it, causing undefined behavior under load. A crash is plausible, but a reliable denial of service has not been shown.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fastnetmon","ddos-detection","ipv6"],"confidence":0.6,"fix_status":"none","needs_auth":"unknown","worst_case":"Detector process may crash; reliable denial of service not established","analyst_note":"Check the linked patch and vendor advisory on github.com for a fixed release; the sources say none exists yet.","how_to_check":"- Check the installed version with the FastNetMon binary or package manager; versions `1.2.9` and earlier are affected.\n- Check whether `networks_list` includes any IPv6 range, since the race needs one to be monitored.","plain_action":"","needs_analyst":true,"not_affected_if":["no-ipv6-networks","newer-version"],"who_is_affected":"Only deployments running FastNetMon 1.2.9 or earlier that monitor IPv6 networks listed in networks_list, and where the IPv6 top-talkers screen is drawn under load. The sources say no fixed release exists yet at review time. Deployments without IPv6 monitoring are not exposed by this race.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000709,"input_tokens":4356,"output_tokens":546,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-92694':14A,17A '1.2.9':75C 'anoth':39B 'avail':155C 'behavior':46B,130C 'caus':44B,127C 'confirm':128C 'counter':100C 'crash':9A,50B,135C 'cve':12A,15A 'ddos':19B,69C 'ddos-detect':18B 'denial':56B,144C 'detect':20B 'detector':11A,70C 'display':6A 'draw':86C,89C 'earlier':77C 'establish':150C 'fastnetmon':1A,21B,23B,63C,78C 'fix':152C 'high':67C 'high-perform':66C 'hold':99C 'includ':121C 'insert':41B,106C 'ipv6':2A,22B,25B,80C,91C,124C 'ipv6_host_counters.average':95C 'iter':94C 'key':108C 'list':119C 'load':48B,132C 'lock':37B 'map':34B,97C,101C,114C 'may':110C 'mutex':102C 'network':118C 'new':107C 'observ':141C 'perform':68C 'plausibl':52B,137C 'process':134C 'race':7A,116C 'rang':125C 'read':31B 'recalcul':104C 'rehash':111C 'releas':153C 'reliabl':55B,143C 'requir':117C 'review':159C 'screen':29B,85C 'screen-draw':84C 'sensor':72C 'servic':58B,146C 'share':33B 'shown':62B 'speed':96C,105C 'src/fastnetmon_logic.cpp':93C 'tabl':90C 'talker':5A,28B,83C 'target':123C 'thread':30B,40B,87C 'top':4A,27B,82C 'top-talk':3A,26B,81C 'undefin':45B,129C 'version':74C 'without':35B,98C","nicknames":[],"mitigations":[],"who_affected":"Only deployments running FastNetMon 1.2.9 or earlier that monitor IPv6 networks listed in networks_list, and where the IPv6 top-talkers screen is drawn under load. The sources say no fixed release exists yet at review time. Deployments without IPv6 monitoring are not exposed by this race.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ddosdetection","fastnetmon","ipv6","medium","other"],"campaign_type":null,"first_public_at":"2026-07-20T11:27:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92694","severity":null,"published_at":"2026-11-05T23:17:02+00:00","modified_at":"2026-11-05T23:17:02+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","fetched_at":"2026-11-05T23:48:40+00:00","note":null}],"documents":[{"id":81505,"url":"https://github.com/pavel-odintsov/fastnetmon/commit/1294724ea931dc78fe545360f2193398bba35381","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81506,"url":"https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-phrw-2q76-5m7h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-20T11:27:59+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}