---
id: "CVE-2026-92695"
page: "https://infrastack.ai/live/CVE-2026-92695"
kind: "vulnerability"
aliases: ["CVE-2026-92695"]
title: "FastNetMon: crafted packets crash the DDoS detector via out-of-bounds read"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "fastnetmon", "fixed": [], "affected": "<= 1.2.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ddos-detection", "fastnetmon", "network-sensor", "package", "pcap"]
not_affected_if: ["not-fastnetmon", "pcap-off"]
published_at: "2026-11-05T23:17:02+00:00"
first_seen_at: "2026-11-05T23:48:40+00:00"
updated_at: "2026-11-05T23:50:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92695", "first_seen_at": "2026-11-05T23:48:40+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-05T23:50:32+00:00"}]
exploit_sources: []
---

# FastNetMon: crafted packets crash the DDoS detector via out-of-bounds read

Link for people: https://infrastack.ai/live/CVE-2026-92695 (this .md is for agents)

FastNetMon, a DDoS detection sensor, reads past the end of captured packet data when pcap capture is enabled, because the parser does not check the captured length. A remote sender of a short or malformed IPv4 frame can make the process crash.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:fastnetmon affected <= 1.2.9 fixed no fixed version listed

## How to check

- Check whether pcap = on in the FastNetMon config (the vulnerable parse_packet() callback is live only then).
- Check the installed version: 1.2.9 and earlier are affected. If you build from git, check whether your tree includes commit 5d0ee2d25fddb2db746ce4ce3326a589a2afef40.

## Fix

No patched release: the advisory lists patched versions as none (affected <= 1.2.9). Commit 5d0ee2d switches the pcap plugin to the default parser; build from source at or after it, or set pcap off.

## Timeline

- 2026-11-05T23:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92695
- 2026-11-05T23:50:32+00:00 analyst — Read GHSA-c27c-943r-vr8h and the fix commit: <=1.2.9, patched versions none, ASan PoC in advisory (no exploitation reported). Commit 5d0ee2d reworks pcap plugin; no release carries it. Vendor states no workaround; pcap off is inferred from the code path.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-c27c-943r-vr8h
- [fix] Patch: github.com https://github.com/pavel-odintsov/fastnetmon/commit/5d0ee2d25fddb2db746ce4ce3326a589a2afef40

## From the sources

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the live parse_packet() callback in src/pcap_plugin/pcap_collector.cpp is registered through pcap_loop and processes captured frames when pcap = on without checking packethdr->caplen. A short frame or an attacker-controlled IPv4 header length can make the parser dereference IP or transport headers beyond the captured bytes, causing an out-of-bounds read and process termination. No fixed release is available as of this review.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_