CVE-2026-92695: FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated frames
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the live parsepacket() callback in src/pcapplugin/pcapcollector.cpp is registered through pcaploop and processes captured frames when pcap = on without checking packethdr->caplen. A short frame or an attacker-controlled IPv4 header length can make the parser dereference IP or transport headers beyond the captured bytes, causing an out-of-bounds read and process termination. No fixed release is available as of this review.
Event History
Frequently Asked Questions
Which deployments are exposed?
FastNetMon versions 1.2.9 and earlier are affected when live packet capture is enabled with pcap = on. The vulnerable callback processes frames received through pcap_loop.
What does an attacker need to do to trigger the issue?
An attacker needs to cause the sensor to process a truncated frame or a packet with an attacker-controlled IPv4 header length. The parser can then read beyond the captured packet bytes, potentially terminating the process.
Is a fix available?
No fixed release was available as of the review. The referenced upstream commit may be relevant for teams evaluating a source-level remediation.