---
id: "CVE-2026-93424"
page: "https://infrastack.ai/live/CVE-2026-93424"
kind: "vulnerability"
aliases: ["CVE-2026-93424"]
title: "FastNetMon: NetFlow template race lets remote senders crash the detector"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "fastnetmon", "fixed": [], "affected": "<= 1.2.9", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ddos-detection", "fastnetmon", "ipfix", "netflow", "package", "self-hosted"]
not_affected_if: ["single-netflow-port", "trusted-exporters-only", "version-above-1.2.9"]
published_at: "2026-11-05T23:17:02+00:00"
first_seen_at: "2026-11-05T23:48:40+00:00"
updated_at: "2026-11-05T23:50:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93424", "first_seen_at": "2026-11-05T23:48:40+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-05T23:50:30+00:00"}]
exploit_sources: []
---

# FastNetMon: NetFlow template race lets remote senders crash the detector

Link for people: https://infrastack.ai/live/CVE-2026-93424 (this .md is for agents)

FastNetMon, a DDoS detector, has a race in its NetFlow template cache where a pointer is used after the memory it points to has been freed. An unauthenticated sender that can reach two NetFlow/IPFIX listener ports can trigger a heap use-after-free and reliably crash the process.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:fastnetmon affected <= 1.2.9 fixed no fixed version listed

## How to check

- Check the FastNetMon config (/etc/fastnetmon.conf) for `netflow_port`: the advisory's PoC precondition is two or more ports, e.g. `netflow_port = 2055,2056`. A single port was the negative control and did not crash.
- Check the version: `fastnetmon --version`; 1.2.9 and earlier are listed affected, and no released version is listed as patched. A source build is fixed only if it includes commit a24e528.
- Check whether those UDP ports are reachable from networks other than your trusted exporters.

## Fix

No patched release: the advisory lists patched versions as None (affected <= 1.2.9). Commit a24e528 (2026-07-20) 'Moved to logic to new copy of template to address security issue GHSA-ph88-95vc-x6gv' changes ipfix_collector.cpp and netflow_v9_collector.cpp; build from a source revision that includes it. Until then, run a single NetFlow/IPFIX listener port and restrict UDP access to trusted exporters.

## Timeline

- 2026-11-05T23:48:40+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93424
- 2026-11-05T23:50:30+00:00 analyst — Read GHSA-ph88-95vc-x6gv and commit a24e528: patched versions None, fix commit on source only. Corrected config key to netflow_port per PoC. PoC is in the advisory (not separately linked); no exploitation reported.

## Documents

- [advisory] Vendor advisory: github.com https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv
- [fix] Patch: github.com https://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9

## From the sources

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_