---
id: "CVE-2026-92698"
page: "https://infrastack.ai/live/CVE-2026-92698"
kind: "vulnerability"
aliases: ["CVE-2026-92698"]
title: "FastNetMon: crafted sFlow packet causes out-of-bounds read and crash"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "fastnetmon", "fixed": [], "affected": "<= 1.2.9", "ecosystem": "github"}]
ecosystems: []
tags: ["ddos-detection", "fastnetmon", "package", "self-hosted", "sflow"]
not_affected_if: ["sflow-disabled", "udp-restricted"]
published_at: "2026-11-05T23:17:02+00:00"
first_seen_at: "2026-11-05T23:48:40+00:00"
updated_at: "2026-11-05T23:50:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-92698", "first_seen_at": "2026-11-05T23:48:40+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-05T23:50:29+00:00"}]
exploit_sources: []
---

# FastNetMon: crafted sFlow packet causes out-of-bounds read and crash

Link for people: https://infrastack.ai/live/CVE-2026-92698 (this .md is for agents)

FastNetMon, a DDoS detector, mishandles a crafted sFlow v5 UDP packet whose inner header size is inflated, so its parser reads past the received buffer. An unauthenticated remote sender can crash the process and may read limited adjacent memory through parsed flow fields.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- github:fastnetmon affected <= 1.2.9 fixed no fixed version listed

## How to check

- Check the installed FastNetMon version against the affected range: `1.2.9` and earlier are affected.
- Check whether the sFlow collector plugin is enabled and listening on UDP, since the flaw is in the sFlow path.

## Fix

No patched release as of the advisory (GHSA-852r-3wcv-pjx2 lists patched versions: None). Upstream commit 6871b73 (2026-07-20, 'Added sanity check ... Addresses GHSA-852r-3wcv-pjx2') adds a length check in src/sflow_plugin/sflow_collector.cpp; build from master at or after that commit until a release ships. Until then, restrict sFlow UDP to trusted exporters or disable the sFlow collector.

## Timeline

- 2026-11-05T23:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-92698
- 2026-11-05T23:50:29+00:00 analyst — Read GHSA: affected <= 1.2.9, patched versions None. Commit 6871b73 is the fix (+41 lines in sflow_collector.cpp); be81c40 is an unrelated metric cleanup, not a fix. PoC is in the advisory (ASan harness, not a public exploit; exploited=false). Whether sFlow is on by default is not stated in the sources; not confirmed. X not searched.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2
- [fix] Patch: github.com https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533
- [fix] Patch: github.com https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83

## From the sources

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_