EUVD-2026-31841
GHSA-4h2g-xxvj-v3w5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
FastNetMon Community Edition through 1.2.9 has out-of-bounds memory access because it incorrectly parses BGP path attributes with the extended length flag set. In src/bgp_protocol.hpp, the parse_raw_bgp_attribute() function correctly identifies when extended_length_bit is set and sets length_of_length_field to 2, but then reads only a single byte for the attribute value length (attribute_value_length = value[2] at line 173). Per RFC 4271 Section 4.3, when the Extended Length bit is set, the Attribute Length field is two octets and the value should be read as a 16-bit big-endian integer from value[2] and value[3]. As a result, any attribute longer than 255 bytes has its length silently truncated to the low byte (e.g., 300 bytes = 0x012C is read as 0x2C = 44 bytes). The remaining 256 bytes are then misinterpreted as subsequent attributes, causing cascading parse failures and potential out-of-bounds memory access.
AnalysisAI
Out-of-bounds memory access in FastNetMon Community Edition through 1.2.9 allows an authenticated BGP peer to crash the monitoring process by sending a crafted UPDATE message. The parser in src/bgp_protocol.hpp correctly detects the RFC 4271 Extended Length flag but reads only one byte of the mandatory two-byte length field, silently truncating attribute lengths above 255 bytes and causing cascading misparse of subsequent BGP data. With CVSS availability impact rated High and SSVC confirming no known active exploitation, this is a targeted denial-of-service risk primarily affecting network operators using FastNetMon for DDoS detection - no public exploit code identified at time of analysis.
Technical ContextAI
FastNetMon is an open-source DDoS detection platform that ingests and parses BGP routing data to identify anomalous traffic. The flaw lives in src/bgp_protocol.hpp within the parse_raw_bgp_attribute() function. RFC 4271 Section 4.3 specifies that when the Extended Length bit (bit 4 of the attribute flags octet) is set in a BGP UPDATE path attribute, the Attribute Length field is two octets and must be interpreted as a 16-bit big-endian integer. The code sets length_of_length_field = 2 correctly upon detecting the flag, but then reads attribute_value_length = value[2] - a single byte - instead of combining value[2] and value[3] into a 16-bit value. For any attribute whose true length exceeds 255 bytes (e.g., 0x012C = 300), the high byte is silently discarded, yielding 0x2C = 44. The 256-byte gap between the actual and parsed length is then fed back into the attribute parser as if it were new attribute data, causing cascading parse failures and potential out-of-bounds memory access into adjacent heap regions. CWE-130 (Improper Handling of Length Parameter Inconsistency) precisely characterizes this root cause: the software encodes a length field in a two-byte format per the protocol specification but reads it as a one-byte value, creating an inconsistency the attacker can control.
RemediationAI
No vendor-released patch has been identified at time of analysis. The targeted code fix requires modifying parse_raw_bgp_attribute() in src/bgp_protocol.hpp at approximately line 173 to replace the single-byte read with a proper RFC 4271-compliant two-byte big-endian read: when extended_length_bit is set, attribute_value_length should be computed as (static_cast<uint16_t>(value[2]) << 8) | value[3] rather than reading value[2] alone. Operators should monitor the FastNetMon GitHub repository (https://github.com/pavel-odintsov/fastnetmon) and the VulDB advisory (https://vuldb.com/vuln/365664) for an official patched release. As a compensating control, restrict BGP peering to explicitly trusted, authenticated peers using TCP MD5 signatures or BGP session authentication - since PR:L requires an established peer session, reducing the set of authorized peers directly reduces attack surface, though it does not eliminate the vulnerability if a trusted peer is compromised or misconfigured. Consider also placing FastNetMon behind a BGP route reflector that strips non-standard extended attributes before forwarding to FastNetMon, though this may suppress legitimate large attributes and affect detection fidelity. No patch version is available to cite from the provided data.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today