FASTNETMON · CVE-2026-93424 · Package
NO FIX YET · SEE WHAT TO DO
FastNetMon, a DDoS detector, has a race in its NetFlow template cache where a pointer is used after the memory it points to has been freed. An unauthenticated sender that can reach two NetFlow/IPFIX listener ports can trigger a heap use-after-free and reliably crash the process.
first public Jul 20, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
FastNetMon 1.2.9 and earlier with two or more NetFlow v9/IPFIX listener ports configured. Any host that can send UDP to two of those ports can crash the daemon within seconds, leaving the monitored network without DDoS detection. Single-port setups, or ports reachable only from trusted exporters, can skip it. The advisory says escalation beyond a crash is plausible but was not attempted.
Not affected if single-netflow-port, trusted-exporters-only, version-above-1.2.9
Who cares ddos-detection, fastnetmon, ipfix, netflow, self-hosted
netflow_port: the advisory's PoC precondition is two or more ports, e.g. netflow_port = 2055,2056. A single port was the negative control and did not crash.fastnetmon --version; 1.2.9 and earlier are listed affected, and no released version is listed as patched. A source build is fixed only if it includes commit a24e528.FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
1.2.9)NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.