CVE-2026-92698: FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read
FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, processsflowflowsample() in src/sflowplugin/sflowcollector.cpp passes the attacker-controlled sflowrawprotocolheadert.headersize to parserawpackettosimplepacketfull() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated headersize creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FastNetMon version 1.2.9 and earlier are affected where the sFlow collector processes sFlow v5 UDP flow samples. The vulnerable path is in process_sflow_flow_sample().
What does an attacker need to exploit it?
An attacker can send a crafted sFlow v5 UDP packet with an inflated header_size value. No authentication, privileges, or user interaction are required.
What is the practical impact?
A malicious header_size can make the parser read beyond the received UDP buffer and crash the FastNetMon process. Adjacent memory bytes may have limited exposure through parsed flow fields.
Is a vendor-fixed release available?
No fixed release was available as of the review. The referenced upstream pull requests may be relevant for evaluating or backporting a remediation.