CVE-2026-92698— FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read

Quick assessment

Affected

pavel-odintsov fastnetmon

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FastNetMon 是一款高性能的 DDoS 检测器与传感器。在 1.2.9 及更早版本中，文件中的函数会将攻击者可控制的直接作为可信的捕获长度，传递给，而未将其与记录中剩余的字节数进行比较。当被恶意放大时，会生成一个超出接收到的 sFlow v5 UDP 缓冲区末尾的错误结束指针，从而绕过嵌套解析器的边界检查，导致未经身份验证的远程越界读取及进程崩溃，并可能通过解析后的流字段有限地暴露相邻字节。截至本次审查，尚未发布修复版本。

CVSS 8.2 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read

Source: CVE Program / CVE List V5

Vulnerability Description

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

跨界内存读

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pavel-odintsov	fastnetmon	<= 1.2.9	-

II. Public POCs for CVE-2026-92698

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-92698

请登录查看更多情报信息。

Other References for CVE-2026-92698 (5)

https://github.com/pavel-odintsov/fastnetmon/pull/1089 x_refsource_MISC
https://github.com/pavel-odintsov/fastnetmon/pull/1093 x_refsource_MISC
https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2 x_refsource_CONFIRM
https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83 x_refsource_MISC
https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-92698

Same Patch Batch · pavel-odintsov · 2026-11-05 · 6 CVEs total

CVE-2026-92695	8.2 HIGH	FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read
CVE-2026-92693	8.2 HIGH	FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser
CVE-2026-92697	7.5 HIGH	FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out
CVE-2026-93424	7.5 HIGH	FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after
CVE-2026-92694	5.9 MEDIUM	FastNetMon: IPv6 host counters map iterated without lock, racing concurrent inserts

IV. Related Vulnerabilities

Same product: fastnetmon

Same vendor: pavel-odintsov

Same weakness: CWE-125