CVE-2026-92697— FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read

Quick assessment

Affected

pavel-odintsov fastnetmon

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FastNetMon 是一款高性能的 DDoS 检测器与传感器。在 1.2.9 及更早版本中，其 NetFlow v9 采集器在调用函数处理攻击者可控制的接口描述字段时，未将扫描范围限制在该字段声明的长度内。尽管长度超过 128 字节的字段会被排除在此操作之外，但若接收到的字段缺少空终止符（null terminator），则可能导致读取超出该字段及数据包缓冲区的范围。未认证的远程攻击者若可向采集器发送特制的 UDP 数据包，即可触发越界读取，进而可能导致进程崩溃，造成拒绝服务（DoS）。截至本次评估，尚未发布修

CVSS 7.5 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1499.004 · Application or System Exploitation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read

Source: CVE Program / CVE List V5

Vulnerability Description

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls strlen() on an attacker-controlled interface-description field without bounding the scan to the field’s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pavel-odintsov	fastnetmon	<= 1.2.9	-

II. Public POCs for CVE-2026-92697

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-92697

请登录查看更多情报信息。

Other References for CVE-2026-92697 (3)

https://github.com/pavel-odintsov/fastnetmon/pull/1088 x_refsource_MISC
https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ff5f-p5jw-8fq2 x_refsource_CONFIRM
https://github.com/pavel-odintsov/fastnetmon/commit/9dc766074dc3048ec5007bc3f6a44f2b42d1e1cb x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-92697

Same Patch Batch · pavel-odintsov · 2026-11-05 · 6 CVEs total

CVE-2026-92698	8.2 HIGH	FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-
CVE-2026-92695	8.2 HIGH	FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read
CVE-2026-92693	8.2 HIGH	FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser
CVE-2026-93424	7.5 HIGH	FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after
CVE-2026-92694	5.9 MEDIUM	FastNetMon: IPv6 host counters map iterated without lock, racing concurrent inserts

IV. Related Vulnerabilities

Same product: fastnetmon

Same vendor: pavel-odintsov

Same weakness: CWE-125