Hi,
The following vulnerabilities were published for fastnetmon.
CVE-2026-93424[0]:
| FastNetMon is a high-performance DDoS detector and sensor. In
| version 1.2.9 and earlier, peer_find_template() in
| src/netflow_plugin/netflow_collector.cpp and
| src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into
| global_netflow9_templates after releasing the cache mutex. On
| deployments with at least two entries in netflow_ports, concurrent
| template redefinition and data-flowset processing can let
| add_update_peer_template() reassign the template and free its
| records vector while another listener dereferences the escaped
| pointer. An unauthenticated sender that can reach both NetFlow/IPFIX
| listener ports can trigger a heap-use-after-free and reliably crash
| FastNetMon. No fixed release is available as of this review.
https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv
Fixed by: https://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9
CVE-2026-92693[3]:
| FastNetMon is a high-performance DDoS detector and sensor. In
| version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full()
| in src/simple_packet_parser_ng.cpp dereferences
| ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is
| present without first verifying that the eight-byte Fragment header
| remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely
| reach this shared parser with the Fragment bytes omitted, causing an
| unauthenticated remote out-of-bounds read. The supplied harness
| detects the read under AddressSanitizer, but the advisory does not
| establish a production process crash. No fixed release is available
| as of this review.
https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93
Fixed by: https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a
CVE-2026-92694[4]:
| FastNetMon is a high-performance DDoS detector and sensor. In
| version 1.2.9 and earlier, FastNetMon's IPv6 top-talkers screen-draw
| thread in draw_table_ipv6() in src/fastnetmon_logic.cpp iterates
| ipv6_host_counters.average_speed_map without holding
| counter_map_mutex while recalculate_speed() inserts new keys and may
| rehash the same map. The race requires networks_list to include the
| targeted IPv6 range. It causes confirmed undefined behavior under
| load; a process crash is plausible but was not observed, so reliable
| denial of service has not been established. No fixed release is
| available as of this review.
https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-phrw-2q76-5m7h
https://github.com/pavel-odintsov/fastnetmon/pull/1087
Fixed by: https://github.com/pavel-odintsov/fastnetmon/commit/1294724ea931dc78fe545360f2193398bba35381
CVE-2026-92695[5]:
| FastNetMon is a high-performance DDoS detector and sensor. In
| version 1.2.9 and earlier, the live parse_packet() callback in
| src/pcap_plugin/pcap_collector.cpp is registered through pcap_loop
| and processes captured frames when pcap = on without checking
| packethdr->caplen. A short frame or an attacker-controlled IPv4
| header length can make the parser dereference IP or transport
| headers beyond the captured bytes, causing an out-of-bounds read and
| process termination. No fixed release is available as of this
| review.
https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-c27c-943r-vr8h
Fixed by: https://github.com/pavel-odintsov/fastnetmon/commit/5d0ee2d25fddb2db746ce4ce3326a589a2afef40
CVE-2026-92697[6]:
| FastNetMon is a high-performance DDoS detector and sensor. In
| version 1.2.9 and earlier, the NetFlow v9 collector calls strlen()
| on an attacker-controlled interface-description field without
| bounding the scan to the field’s declared length. Although fields
| longer than 128 bytes are excluded from this operation, an accepted
| field without a null terminator can cause reads beyond the field and
| packet buffer. An unauthenticated remote attacker who can send
| crafted UDP packets to the collector can trigger an out-of-bounds
| read and potentially crash the process, causing denial of service.
| No fixed release is available as of this review.
https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2
https://github.com/pavel-odintsov/fastnetmon/pull/1088
Fixed by: https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb
CVE-2026-92698[7]:
| FastNetMon is a high-performance DDoS detector and sensor. In
| version 1.2.9 and earlier, process_sflow_flow_sample() in
| src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled
| sflow_raw_protocol_header_t.header_size to
| parse_raw_packet_to_simple_packet_full() as its trusted captured
| length without comparing it with the bytes remaining in the record.
| An inflated header_size creates a false end pointer beyond the
| received sFlow v5 UDP buffer, defeating the nested parser's bounds
| checks and causing an unauthenticated remote out-of-bounds read and
| process crash, with possible limited exposure of adjacent bytes
| through parsed flow fields. No fixed release is available as of this
| review.
https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2
https://github.com/pavel-odintsov/fastnetmon/pull/1089
Fixed by: https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533
https://github.com/pavel-odintsov/fastnetmon/pull/1093
Fixed by: https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-93424
https://www.cve.org/CVERecord?id=CVE-2026-93424
[1] https://security-tracker.debian.org/tracker/CVE-2026-48682
https://www.cve.org/CVERecord?id=CVE-2026-48682
[2] https://security-tracker.debian.org/tracker/CVE-2026-48697
https://www.cve.org/CVERecord?id=CVE-2026-48697
[3] https://security-tracker.debian.org/tracker/CVE-2026-92693
https://www.cve.org/CVERecord?id=CVE-2026-92693
[4] https://security-tracker.debian.org/tracker/CVE-2026-92694
https://www.cve.org/CVERecord?id=CVE-2026-92694
[5] https://security-tracker.debian.org/tracker/CVE-2026-92695
https://www.cve.org/CVERecord?id=CVE-2026-92695
[6] https://security-tracker.debian.org/tracker/CVE-2026-92697
https://www.cve.org/CVERecord?id=CVE-2026-92697
[7] https://security-tracker.debian.org/tracker/CVE-2026-92698
https://www.cve.org/CVERecord?id=CVE-2026-92698
Please adjust the affected versions in the BTS as needed.