DEBIAN-CVE-2026-122130: Integer Overflow
Published Nov 4, 2026
·Updated
CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.
Affected Software
1 affected componentFixes available
debian/ipfixcol2<2.9.0-1
2.9.0-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/ipfixcol2to a version that resolves this vulnerability.Fixed in 2.9.0-1 - Upgrade
Upgrade
CESNET ipfixcol2to a version that resolves this vulnerability.Fixed in 2.9.0
Event History
Nov 4, 2026
CVE Published
via OSV·09:18 PM
Data Sourced
via OSV·09:18 PM
DescriptionSeverityAffected Software