CVE-2026-92693— FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser

Quick assessment

Affected

pavel-odintsov fastnetmon

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FastNetMon 是一款高性能的 DDoS 检测器与传感器。在 1.2.9 及更早版本中，文件中的函数在检测到（即 IPv6 分片头）时，会直接解引用结构体，而未先验证剩余的八个字节分片头数据是否完整。攻击者可构造一个省略了分片字段的 sFlow v5 记录，从而远程触发该共享解析器，导致未认证的远程越界读取漏洞。提供的测试程序在 AddressSanitizer（地址 sanitizer）环境下能够检测到此次越界读取，但官方公告并未确认该漏洞在生产环境中会导致进程崩溃。截至本次评估，尚未发布修复该问题

CVSS 8.2 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser

Source: CVE Program / CVE List V5

Vulnerability Description

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pavel-odintsov	fastnetmon	<= 1.2.9	-

II. Public POCs for CVE-2026-92693

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-92693

请登录查看更多情报信息。

Other References for CVE-2026-92693 (2)

https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93 x_refsource_CONFIRM
https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-92693

Same Patch Batch · pavel-odintsov · 2026-11-05 · 6 CVEs total

CVE-2026-92698	8.2 HIGH	FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-
CVE-2026-92695	8.2 HIGH	FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read
CVE-2026-92697	7.5 HIGH	FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out
CVE-2026-93424	7.5 HIGH	FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after
CVE-2026-92694	5.9 MEDIUM	FastNetMon: IPv6 host counters map iterated without lock, racing concurrent inserts

IV. Related Vulnerabilities

Same product: fastnetmon

Same vendor: pavel-odintsov

Same weakness: CWE-125