{"id":"CVE-2026-92695","kind":"vulnerability","aliases":["CVE-2026-92695"],"related":[],"title":"FastNetMon: crafted packets crash the DDoS detector via out-of-bounds read","description":"FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the live parse_packet() callback in src/pcap_plugin/pcap_collector.cpp is registered through pcap_loop and processes captured frames when pcap = on without checking packethdr->caplen. A short frame or an attacker-controlled IPv4 header length can make the parser dereference IP or transport headers beyond the captured bytes, causing an out-of-bounds read and process termination. No fixed release is available as of this review.","summary":"FastNetMon, a DDoS detection sensor, reads past the end of captured packet data when pcap capture is enabled, because the parser does not check the captured length. A remote sender of a short or malformed IPv4 frame can make the process crash.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fastnetmon","fixed":[],"affected":"<= 1.2.9","ecosystem":"vendor"}],"ecosystems":[],"tags":["ddos-detection","fastnetmon","network-sensor","package","pcap"],"not_affected_if":["not-fastnetmon","pcap-off"],"how_to_check":"- Check whether pcap = on in the FastNetMon config (the vulnerable parse_packet() callback is live only then).\n- Check the installed version: 1.2.9 and earlier are affected. If you build from git, check whether your tree includes commit 5d0ee2d25fddb2db746ce4ce3326a589a2afef40.","fix":"No patched release: the advisory lists patched versions as none (affected <= 1.2.9). Commit 5d0ee2d switches the pcap plugin to the default parser; build from source at or after it, or set pcap off.","status":"open","published_at":"2026-11-05T23:17:02+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","triaged_at":"2026-11-05T23:49:37+00:00","updated_at":"2026-11-05T23:50:32+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-05T23:49:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FastNetMon: crafted packets crash the DDoS detector via out-of-bounds read","impact":"low","summary":"FastNetMon, a DDoS detection sensor, reads past the end of captured packet data when pcap capture is enabled, because the parser does not check the captured length. A remote sender of a short or malformed IPv4 frame can make the process crash.","audience":"businesses","category":"package","nicknames":[],"who_cares":["fastnetmon","ddos-detection","pcap","network-sensor"],"confidence":0.7,"fix_status":"none","needs_auth":"no","worst_case":"attacker crashes the sensor process via crafted packets","analyst_note":"Sources say no fixed release exists yet; confirm current status and any workaround in the vendor advisory linked from the sources.","how_to_check":"- Check whether `pcap` is set to `on` in the FastNetMon configuration.\n- Check the installed FastNetMon version against the affected range (1.2.9 and earlier).","plain_action":"","needs_analyst":true,"not_affected_if":["pcap-off","not-fastnetmon"],"who_is_affected":"Only deployments that run FastNetMon's live pcap capture (`pcap = on`) are exposed, because the flawed callback in pcap_collector.cpp handles captured frames only in that mode. Teams running FastNetMon on a mirror or sensor port that receives attacker-influenced traffic should look first. Deployments with pcap capture off, or not running FastNetMon, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000717,"input_tokens":4313,"output_tokens":571,"severity_before":"high"},"analyst_status":"done","analyst_note":"Sources say no fixed release exists yet; confirm current status and any workaround in the vendor advisory linked from the sources.","search":"'-2026':15A,18A '-92695':16A,19A '1.2.9':84C 'attack':116C 'attacker-control':115C 'avail':148C 'beyond':130C 'bound':12A,139C 'byte':133C 'callback':91C 'caplen':109C 'captur':40B,45B,55B,101C,132C 'caus':134C 'check':53B,107C 'control':117C 'craft':2A 'crash':4A,71B 'cve':14A,17A 'data':42B 'ddos':6A,22B,32B,78C 'ddos-detect':21B 'derefer':125C 'detect':23B,33B 'detector':7A,79C 'earlier':86C 'enabl':47B 'end':38B 'fastnetmon':1A,20A,24B,30B,72C 'fix':145C 'frame':66B,102C,112C 'header':119C,129C 'high':76C 'high-perform':75C 'ip':126C 'ipv4':65B,118C 'length':56B,120C 'live':88C 'loop':98C 'make':68B,122C 'malform':64B 'network':26B 'network-sensor':25B 'out-of-bound':9A,136C 'packag':28B 'packet':3A,41B,90C 'packethdr':108C 'pars':89C 'parser':50B,124C 'past':36B 'pcap':29B,44B,97C,104C 'perform':77C 'process':70B,100C,142C 'read':13A,35B,140C 'regist':95C 'releas':146C 'remot':58B 'review':152C 'sender':59B 'sensor':27B,34B,81C 'short':62B,111C 'src/pcap_plugin/pcap_collector.cpp':93C 'termin':143C 'transport':128C 'version':83C 'via':8A 'without':106C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that run FastNetMon's live pcap capture (`pcap = on`) are exposed, because the flawed callback in pcap_collector.cpp handles captured frames only in that mode. Teams running FastNetMon on a mirror or sensor port that receives attacker-influenced traffic should look first. Deployments with pcap capture off, or not running FastNetMon, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-05T23:50:32Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/5d0ee2d25fddb2db746ce4ce3326a589a2afef40","run_id":1843},"products":{"at":"2026-11-05T23:50:32Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/5d0ee2d25fddb2db746ce4ce3326a589a2afef40","run_id":1843},"how_to_check":{"at":"2026-11-05T23:50:32Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/5d0ee2d25fddb2db746ce4ce3326a589a2afef40","run_id":1843},"who_affected":{"at":"2026-11-05T23:50:32Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/5d0ee2d25fddb2db746ce4ce3326a589a2afef40","run_id":1843}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fastnetmon"],"ptokens":["fastnetmon"],"labels":["ddosdetection","fastnetmon","high","networksensor","package","pcap"],"campaign_type":null,"first_public_at":"2026-07-20T11:38:07+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92695","severity":null,"published_at":"2026-11-05T23:17:02+00:00","modified_at":"2026-11-05T23:17:02+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","fetched_at":"2026-11-05T23:48:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92695:1843","url":null,"severity":null,"published_at":"2026-11-05T23:50:32+00:00","modified_at":"2026-11-05T23:50:32+00:00","first_seen_at":"2026-11-05T23:50:32+00:00","fetched_at":"2026-11-05T23:50:32+00:00","note":"Read GHSA-c27c-943r-vr8h and the fix commit: <=1.2.9, patched versions none, ASan PoC in advisory (no exploitation reported). Commit 5d0ee2d reworks pcap plugin; no release carries it. Vendor states no workaround; pcap off is inferred from the code path."}],"documents":[{"id":81507,"url":"https://github.com/pavel-odintsov/fastnetmon/commit/5d0ee2d25fddb2db746ce4ce3326a589a2afef40","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81508,"url":"https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-c27c-943r-vr8h","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-20T11:38:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}