DEBIAN-CVE-2026-122129: Medium severity debian/ipfixcol2 vulnerability

Q: Which deployments should be prioritized for remediation?

Prioritize ipfixcol2 collectors that accept TCP connections from untrusted or broadly reachable networks and process LZ4 start headers. An unauthenticated remote attacker can trigger memory allocation without needing credentials or user interaction.

Q: What versions are affected, and how can I check exposure?

The affected range is ipfixcol2 2.7.1 through versions before 2.9.0. Check the installed ipfixcol2 version on Debian systems and treat any version in that range as vulnerable.

Q: What is the practical availability impact?

A malicious LZ4 start header can request a ring buffer allocation of up to 4 GiB for a single TCP connection. Repeated connections can exhaust collector memory and deny service.

Published Nov 4, 2026

Updated

CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::readstartheader() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service.

Affected Software

1 affected componentFixes available

debian/ipfixcol2<2.9.0-1

2.9.0-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ipfixcol2 to a version that resolves this vulnerability.
Fixed in 2.9.0-1
Upgrade
Upgrade CESNET ipfixcol2 to a version that resolves this vulnerability.
Fixed in 2.9.0

Event History

Nov 4, 2026

CVE Published

via OSV·09:18 PM

Data Sourced

via OSV·09:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments should be prioritized for remediation?

Prioritize ipfixcol2 collectors that accept TCP connections from untrusted or broadly reachable networks and process LZ4 start headers. An unauthenticated remote attacker can trigger memory allocation without needing credentials or user interaction.

What versions are affected, and how can I check exposure?

The affected range is ipfixcol2 2.7.1 through versions before 2.9.0. Check the installed ipfixcol2 version on Debian systems and treat any version in that range as vulnerable.

What is the practical availability impact?

A malicious LZ4 start header can request a ring buffer allocation of up to 4 GiB for a single TCP connection. Repeated connections can exhaust collector memory and deny service.

DEBIAN-CVE-2026-122129: Medium severity debian/ipfixcol2 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments should be prioritized for remediation?

What versions are affected, and how can I check exposure?

What is the practical availability impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for remediation?

What versions are affected, and how can I check exposure?

What is the practical availability impact?