DEBIAN-CVE-2026-122127: Buffer Overflow

Q: Which deployments are exposed to this issue?

Debian deployments running CESNET ipfixcol2 versions from 2.7.1 up to, but not including, 2.9.0 are affected. The vulnerable component is the LZ4 decoder used by the collector.

Q: What does an attacker need to exploit it?

An attacker only needs network access to the collector as an unauthenticated peer. They can send crafted input declaring a small ring buffer_size and a large decompressed_size.

Q: What is the likely impact of exploitation?

A crafted payload can write up to 65,535 attacker-controlled bytes past a heap buffer. The described impact is a crash of the collector.

Q: Is authentication or user interaction required?

No. The issue is remotely reachable over the network, requires no privileges or authentication, and does not require user interaction.

Published Nov 4, 2026

Updated

CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffersize followed by a large decompressedsize to write up to 65535 controlled bytes and crash the collector.

Affected Software

1 affected componentFixes available

debian/ipfixcol2<2.9.0-1

2.9.0-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ipfixcol2 to a version that resolves this vulnerability.
Fixed in 2.9.0-1
Upgrade
Upgrade CESNET ipfixcol2 to a version that resolves this vulnerability.
Fixed in 2.9.0

Event History

Nov 4, 2026

CVE Published

via OSV·09:18 PM

Data Sourced

via OSV·09:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Debian deployments running CESNET ipfixcol2 versions from 2.7.1 up to, but not including, 2.9.0 are affected. The vulnerable component is the LZ4 decoder used by the collector.

What does an attacker need to exploit it?

An attacker only needs network access to the collector as an unauthenticated peer. They can send crafted input declaring a small ring buffer_size and a large decompressed_size.

What is the likely impact of exploitation?

A crafted payload can write up to 65,535 attacker-controlled bytes past a heap buffer. The described impact is a crash of the collector.

Is authentication or user interaction required?

No. The issue is remotely reachable over the network, requires no privileges or authentication, and does not require user interaction.

DEBIAN-CVE-2026-122127: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of exploitation?

Is authentication or user interaction required?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the likely impact of exploitation?

Is authentication or user interaction required?