CVE-2026-122129: CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder
CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::readstartheader() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CESNET ipfixcol2to a version that resolves this vulnerability.Fixed in 2.9.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
ipfixcol2 versions from 2.7.1 up to, but not including, 2.9.0 are affected. Exposure requires the collector to accept TCP connections that can deliver LZ4 start headers.
What does an attacker need to exploit the vulnerability?
An attacker does not need authentication or user interaction. They can open TCP connections and send LZ4 start headers declaring very large ring buffer sizes.
What is the practical impact of a successful attack?
Each malicious connection can force an allocation of up to 4 GiB of memory. Repeated connections can exhaust available memory and deny service to the collector.