CVE-2026-122127: CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder
CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffersize followed by a large decompressedsize to write up to 65535 controlled bytes and crash the collector.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CESNET ipfixcol2to a version that resolves this vulnerability.Fixed in 2.9.0
Event History
Frequently Asked Questions
Which deployments are exposed?
CESNET ipfixcol2 versions 2.7.1 through versions before 2.9.0 are affected when they accept traffic from network peers using the TCP LZ4 decoder. The issue can be reached by an unauthenticated peer.
What does an attacker need to send to trigger the overflow?
An attacker needs network access to the collector and can send crafted decoder input without authentication or user interaction. The input declares a small ring buffer_size followed by a large decompressed_size, enabling writes of up to 65,535 controlled bytes past heap buffers.
What is the practical impact?
The supplied data states that the overflow can crash the collector, resulting in a denial of service. It does not establish code execution or confidentiality or integrity impact.
How can I determine whether an instance is affected?
Check the deployed ipfixcol2 version. Versions starting at 2.7.1 and earlier than 2.9.0 are affected; version 2.9.0 is the referenced fixed release.