FASTNETMON · CVE-2026-92697 · Other
NO FIX YET · SEE WHAT TO DO
FastNetMon, a DDoS detection sensor, reads an attacker-controlled NetFlow v9 interface-description field without bounding its length, so a missing null terminator makes it read past the packet buffer. An unauthenticated remote attacker sending crafted UDP packets can crash the process, causing denial of service.
first public Jul 20, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running FastNetMon 1.2.9 or earlier with the NetFlow v9 collector enabled. One crafted UDP packet from anyone who can reach the collector port, with no authentication, crashes the process, so detection stops. Skip if the NetFlow collector is off or the port is reachable only from trusted exporters.
Not affected if netflow-collector-disabled, no-untrusted-udp-access
Who cares fastnetmon, netflow, self-hosted
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls strlen() on an attacker-controlled interface-description field without bounding the scan to the field’s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.