CVE-2026-122130: CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin
CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CESNET ipfixcol2to a version that resolves this vulnerability.Fixed in 2.9.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Collectors running ipfixcol2 versions from 2.3.0 up to, but not including, 2.9.0 are affected when they use the Forwarder output plugin to forward data over TCP. The vulnerable input can come from unauthenticated IPFIX exporters.
What does an attacker need to do to exploit it?
An attacker needs network access to submit IPFIX data to the collector as an exporter. Exploitation involves sending near-65535-byte data sets together with large templates, causing uint16_t message-length counters to wrap.
What is the practical impact of successful exploitation?
The condition can crash the collector and permits 2-byte writes to attacker-influenced addresses. The reported severity vector indicates high availability impact and low integrity impact, with no reported confidentiality impact.
What should be done if an immediate upgrade is not possible?
The provided information identifies unauthenticated IPFIX exporters as the attack source but does not specify a vendor workaround. Restricting which systems can reach the collector's IPFIX ingestion interface can reduce exposure until upgrading to 2.9.0.