{"id":"CVE-2026-92698","kind":"vulnerability","aliases":["CVE-2026-92698"],"related":[],"title":"FastNetMon: crafted sFlow packet causes out-of-bounds read and crash","description":"FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review.","summary":"FastNetMon, a DDoS detector, mishandles a crafted sFlow v5 UDP packet whose inner header size is inflated, so its parser reads past the received buffer. An unauthenticated remote sender can crash the process and may read limited adjacent memory through parsed flow fields.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"fastnetmon","fixed":[],"affected":"<= 1.2.9","ecosystem":"github"}],"ecosystems":[],"tags":["ddos-detection","fastnetmon","package","self-hosted","sflow"],"not_affected_if":["sflow-disabled","udp-restricted"],"how_to_check":"- Check the installed FastNetMon version against the affected range: `1.2.9` and earlier are affected.\n- Check whether the sFlow collector plugin is enabled and listening on UDP, since the flaw is in the sFlow path.","fix":"No patched release as of the advisory (GHSA-852r-3wcv-pjx2 lists patched versions: None). Upstream commit 6871b73 (2026-07-20, 'Added sanity check ... Addresses GHSA-852r-3wcv-pjx2') adds a length check in src/sflow_plugin/sflow_collector.cpp; build from master at or after that commit until a release ships. Until then, restrict sFlow UDP to trusted exporters or disable the sFlow collector.","status":"open","published_at":"2026-11-05T23:17:02+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","triaged_at":"2026-11-05T23:49:36+00:00","updated_at":"2026-11-05T23:50:29+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-05T23:49:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"FastNetMon: crafted sFlow packet causes out-of-bounds read and crash","impact":"medium","summary":"FastNetMon, a DDoS detector, mishandles a crafted sFlow v5 UDP packet whose inner header size is inflated, so its parser reads past the received buffer. An unauthenticated remote sender can crash the process and may read limited adjacent memory through parsed flow fields.","audience":"businesses","category":"package","nicknames":[],"who_cares":["fastnetmon","sflow","self-hosted","ddos-detection"],"confidence":0.7,"fix_status":"none","needs_auth":"no","worst_case":"Remote crash of the collector process and limited memory read","analyst_note":"Confirm whether a vendor fix or patch exists beyond the linked GitHub patch and advisory pages, and whether sFlow collection is on by default.","how_to_check":"- Check the installed FastNetMon version against the affected range: `1.2.9` and earlier are affected.\n- Check whether the sFlow collector plugin is enabled and listening on UDP, since the flaw is in the sFlow path.","plain_action":"","needs_analyst":true,"not_affected_if":["sflow-disabled","udp-restricted"],"who_is_affected":"Teams running FastNetMon 1.2.9 or earlier with the sFlow collector enabled and reachable over UDP. Deployments that do not use sFlow ingestion, or that restrict sFlow UDP traffic to trusted exporters, are less exposed. The sources state no fixed release is available yet.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000734,"input_tokens":4403,"output_tokens":588,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether a vendor fix or patch exists beyond the linked GitHub patch and advisory pages, and whether sFlow collection is on by default.","search":"'-2026':14A,17A '-92698':15A,18A '1.2.9':84C 'adjac':66B,164C 'attack':96C 'attacker-control':95C 'avail':174C 'beyond':132C 'bound':9A,144C,154C 'buffer':53B,138C 'byte':118C,165C 'captur':111C 'caus':5A,147C 'check':145C 'compar':114C 'control':97C 'craft':2A,35B 'crash':12A,59B,158C 'creat':127C 'cve':13A,16A 'ddos':21B,31B,78C 'ddos-detect':20B 'defeat':139C 'detect':22B 'detector':32B,79C 'earlier':86C 'end':130C 'exposur':162C 'fals':129C 'fastnetmon':1A,19A,23B,29B,72C 'field':71B,169C 'fix':171C 'flow':70B,89C,168C 'full':107C 'header':42B,125C 'high':76C 'high-perform':75C 'host':27B 'inflat':45B,124C 'inner':41B 'length':112C 'limit':65B,161C 'may':63B 'memori':67B 'mishandl':33B 'nest':141C 'out-of-bound':6A,151C 'packag':24B 'packet':4A,39B,103C,106C 'pars':69B,101C,167C 'parser':48B,142C 'pass':93C 'past':50B 'perform':77C 'pointer':131C 'possibl':160C 'process':61B,87C,157C 'raw':102C 'read':10A,49B,64B,155C 'receiv':52B,134C 'record':122C 'releas':172C 'remain':119C 'remot':56B,150C 'review':178C 'sampl':90C 'self':26B 'self-host':25B 'sender':57B 'sensor':81C 'sflow':3A,28B,36B,88C,135C 'sflow_raw_protocol_header_t.header':98C 'simpl':105C 'size':43B,99C,126C 'src/sflow_plugin/sflow_collector.cpp':92C 'trust':110C 'udp':38B,137C 'unauthent':55B,149C 'v5':37B,136C 'version':83C 'whose':40B 'without':113C","nicknames":[],"mitigations":[],"who_affected":"Teams running FastNetMon 1.2.9 or earlier with the sFlow collector enabled and reachable over UDP. Deployments that do not use sFlow ingestion, or that restrict sFlow UDP traffic to trusted exporters, are less exposed. The sources state no fixed release is available yet.","tier":"B","verified":{"fix":{"at":"2026-11-05T23:50:29Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533","run_id":1841},"products":{"at":"2026-11-05T23:50:29Z","by":"analyst","doc":"https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533","run_id":1841}},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["fastnetmon"],"ptokens":["fastnetmon"],"labels":["ddosdetection","fastnetmon","high","package","selfhosted","sflow"],"campaign_type":null,"first_public_at":"2026-07-20T15:06:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-92698","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92698","severity":null,"published_at":"2026-11-05T23:17:02+00:00","modified_at":"2026-11-05T23:17:02+00:00","first_seen_at":"2026-11-05T23:48:40+00:00","fetched_at":"2026-11-05T23:48:40+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-92698:1841","url":null,"severity":null,"published_at":"2026-11-05T23:50:29+00:00","modified_at":"2026-11-05T23:50:29+00:00","first_seen_at":"2026-11-05T23:50:29+00:00","fetched_at":"2026-11-05T23:50:29+00:00","note":"Read GHSA: affected <= 1.2.9, patched versions None. Commit 6871b73 is the fix (+41 lines in sflow_collector.cpp); be81c40 is an unrelated metric cleanup, not a fix. PoC is in the advisory (ASan harness, not a public exploit; exploited=false). Whether sFlow is on by default is not stated in the sources; not confirmed. X not searched."}],"documents":[{"id":81511,"url":"https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81512,"url":"https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":81513,"url":"https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-20T15:06:23+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}