---
id: "CVE-2026-92697"
page: "https://infrastack.ai/live/CVE-2026-92697"
kind: "vulnerability"
aliases: ["CVE-2026-92697"]
title: "FastNetMon: crafted NetFlow packets can crash the DDoS detector collector"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "fastnetmon", "fixed": [], "affected": "<= 1.2.9", "ecosystem": "other"}]
ecosystems: []
tags: ["fastnetmon", "netflow", "other", "self-hosted"]
not_affected_if: ["netflow-collector-disabled", "no-untrusted-udp-access"]
published_at: "2026-11-05T23:17:02+00:00"
first_seen_at: "2026-11-05T23:48:40+00:00"
updated_at: "2026-11-05T23:50:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92697", "first_seen_at": "2026-11-05T23:48:40+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-05T23:50:27+00:00"}]
exploit_sources: []
---

# FastNetMon: crafted NetFlow packets can crash the DDoS detector collector

Link for people: https://infrastack.ai/live/CVE-2026-92697 (this .md is for agents)

FastNetMon, a DDoS detection sensor, reads an attacker-controlled NetFlow v9 interface-description field without bounding its length, so a missing null terminator makes it read past the packet buffer. An unauthenticated remote attacker sending crafted UDP packets can crash the process, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:fastnetmon affected <= 1.2.9 fixed no fixed version listed

## How to check

- Run fastnetmon --version (or check your package): 1.2.9 and earlier are affected; no release is fixed.
- Check whether the NetFlow v9 collector is enabled in fastnetmon.conf and which UDP port it listens on; confirm that port accepts packets only from your known routers (firewall/ACL).
- If you build from source, check that your tree contains commit 9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb.

## Fix

No patched release: the advisory lists patched versions as None. Upstream commit 9dc7660 (2026-07-20) adds a length limit for the NetFlow v9 interface name; build from master at or after that commit until a release ships. Until then, restrict the NetFlow UDP port to your known exporters.

## Timeline

- 2026-11-05T23:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92697
- 2026-11-05T23:50:27+00:00 analyst — Read GHSA-ff5f-p5jw-8fq2 (vendor): affected <=1.2.9, patched versions None; commit 9dc7660 on the repo adds a length limit but no release yet. PoC in advisory (ASan harness, not a live-service test).

## Documents

- [advisory] Vendor advisory: github.com https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2
- [fix] Patch: github.com https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb

## From the sources

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls  strlen()  on an attacker-controlled interface-description field without bounding the scan to the field’s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_