CVE-2026-93424— FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments

Quick assessment

Affected

pavel-odintsov fastnetmon

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

FastNetMon 是一款高性能的 DDoS 检测器与传感器。在 1.2.9 及更早版本中，和中的函数在释放缓存互斥锁（mutex）后，返回了一个指向全局变量的指针。在配置中至少包含两个入口的部署环境中，若并发执行模板重新定义与数据流集（data-flowset）处理，可能会重新分配模板并释放其记录向量（records vector），而此时另一个监听器仍在解引用该已逃逸的指针。任何能够同时访问 NetFlow/IPFIX 监听端口的未认证发送者均可触发堆释放后使用（heap-use-after-fr

CVSS 7.5 · High Updated Nov 06, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments

Source: CVE Program / CVE List V5

Vulnerability Description

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

释放后使用

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
pavel-odintsov	fastnetmon	<= 1.2.9	-

II. Public POCs for CVE-2026-93424

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-93424

请登录查看更多情报信息。

Other References for CVE-2026-93424 (2)

https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv x_refsource_CONFIRM
https://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-93424

Same Patch Batch · pavel-odintsov · 2026-11-05 · 6 CVEs total

CVE-2026-92698	8.2 HIGH	FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-
CVE-2026-92695	8.2 HIGH	FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read
CVE-2026-92693	8.2 HIGH	FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser
CVE-2026-92697	7.5 HIGH	FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out
CVE-2026-92694	5.9 MEDIUM	FastNetMon: IPv6 host counters map iterated without lock, racing concurrent inserts

IV. Related Vulnerabilities

Same product: fastnetmon

Same vendor: pavel-odintsov

Same weakness: CWE-416