{"id":"CVE-2026-92697","kind":"vulnerability","aliases":["CVE-2026-92697"],"related":[],"title":"FastNetMon: crafted NetFlow packets can crash the DDoS detector collector","description":"FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls  strlen()  on an attacker-controlled interface-description field without bounding the scan to the field’s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review.","summary":"FastNetMon, a DDoS detection sensor, reads an attacker-controlled NetFlow v9 interface-description field without bounding its length, so a missing null terminator makes it read past the packet buffer. An unauthenticated remote attacker sending crafted UDP packets can crash the process, causing denial of service.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fastnetmon","fixed":[],"affected":"<= 1.2.9","ecosystem":"other"}],"ecosystems":[],"tags":["fastnetmon","netflow","other","self-hosted"],"not_affected_if":["netflow-collector-disabled","no-untrusted-udp-access"],"how_to_check":"- Run fastnetmon --version (or check your package): 1.2.9 and earlier are affected; no release is fixed.\n- Check whether the NetFlow v9 collector is enabled in fastnetmon.conf and which UDP port it listens on; confirm that port accepts packets only from your known routers (firewall/ACL).\n- If you build from source, check that your tree contains commit 9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb.","fix":"No patched release: the advisory lists patched versions as None. Upstream commit 9dc7660 (2026-07-20) adds a length limit for the NetFlow v9 interface name; build from master at or after that commit until a release ships. Until then, restrict the NetFlow UDP port to your known exporters.","status":"open","published_at":"2026-11-05T23:17:02+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","triaged_at":"2026-11-05T23:49:41+00:00","updated_at":"2026-11-05T23:50:27+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-05T23:49:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"FastNetMon: crafted NetFlow packets can crash the DDoS detector collector","impact":"low","summary":"FastNetMon, a DDoS detection sensor, reads an attacker-controlled NetFlow v9 interface-description field without bounding its length, so a missing null terminator makes it read past the packet buffer. An unauthenticated remote attacker sending crafted UDP packets can crash the process, causing denial of service.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fastnetmon","netflow","self-hosted"],"confidence":0.7,"fix_status":"none","needs_auth":"no","worst_case":"Collector process crashes, causing denial of service on the sensor","analyst_note":"Check the vendor advisory and patch links for a fixed release; the description says none exists as of review.","how_to_check":"- Check the installed FastNetMon version against the affected range: version 1.2.9 and earlier are affected.\n- Check whether the NetFlow v9 collector is enabled and reachable over UDP from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["netflow-collector-disabled","no-untrusted-udp-access"],"who_is_affected":"Teams running FastNetMon as a DDoS detector or sensor that receives NetFlow v9 over UDP. The NetFlow v9 collector is the exposed path; exposure depends on whether that UDP port can be reached by untrusted senders. Deployments that do not run the NetFlow v9 collector or keep it off untrusted networks are less exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000731,"input_tokens":4341,"output_tokens":594,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the vendor advisory and patch links for a fixed release; the description says none exists as of review.","search":"'-2026':12A,15A '-92697':13A,16A '1.2.9':84C '128':116C 'accept':124C 'although':112C 'attack':32B,59B,96C,142C 'attacker-control':31B,95C 'avail':173C 'beyond':133C 'bound':41B,103C,158C 'buffer':55B,138C 'byte':117C 'call':91C 'caus':68B,131C,165C 'collector':10A,90C,151C 'control':33B,97C 'craft':2A,61B,146C 'crash':6A,65B,162C 'cve':11A,14A 'ddos':8A,26B,78C 'declar':110C 'denial':69B,166C 'descript':38B,100C 'detect':27B 'detector':9A,79C 'earlier':86C 'exclud':119C 'fastnetmon':1A,17A,18B,24B,72C 'field':39B,101C,108C,113C,125C,135C 'fix':170C 'high':76C 'high-perform':75C 'host':23B 'interfac':37B,99C 'interface-descript':36B,98C 'length':43B,111C 'longer':114C 'make':49B 'miss':46B 'netflow':3A,19B,34B,88C 'null':47B,128C 'oper':122C 'out-of-bound':155C 'packet':4A,54B,63B,137C,148C 'past':52B 'perform':77C 'potenti':161C 'process':67B,164C 'read':29B,51B,132C,159C 'releas':171C 'remot':58B,141C 'review':177C 'scan':105C 'self':22B 'self-host':21B 'send':60B,145C 'sensor':28B,81C 'servic':71B,168C 'strlen':92C 'termin':48B,129C 'trigger':153C 'udp':62B,147C 'unauthent':57B,140C 'v9':35B,89C 'version':83C 'without':40B,102C,126C","nicknames":[],"mitigations":[],"who_affected":"Teams running FastNetMon 1.2.9 or earlier with the NetFlow v9 collector enabled. One crafted UDP packet from anyone who can reach the collector port, with no authentication, crashes the process, so detection stops. Skip if the NetFlow collector is off or the port is reachable only from trusted exporters.","tier":"B","verified":{"fix":{"at":"2026-11-05T23:50:27Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb","run_id":1842},"products":{"at":"2026-11-05T23:50:27Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb","run_id":1842},"how_to_check":{"at":"2026-11-05T23:50:27Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb","run_id":1842},"who_affected":{"at":"2026-11-05T23:50:27Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb","run_id":1842}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fastnetmon"],"ptokens":["fastnetmon"],"labels":["fastnetmon","high","netflow","other","selfhosted"],"campaign_type":null,"first_public_at":"2026-07-20T14:37:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92697","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92697","severity":null,"published_at":"2026-11-05T23:17:02+00:00","modified_at":"2026-11-05T23:17:02+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","fetched_at":"2026-11-05T23:48:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92697:1842","url":null,"severity":null,"published_at":"2026-11-05T23:50:27+00:00","modified_at":"2026-11-05T23:50:27+00:00","first_seen_at":"2026-11-05T23:50:27+00:00","fetched_at":"2026-11-05T23:50:27+00:00","note":"Read GHSA-ff5f-p5jw-8fq2 (vendor): affected <=1.2.9, patched versions None; commit 9dc7660 on the repo adds a length limit but no release yet. PoC in advisory (ASan harness, not a live-service test)."}],"documents":[{"id":81509,"url":"https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81510,"url":"https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-20T14:37:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}