EUVD-2026-31839
GHSA-242v-wx3w-qx8x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read vulnerability in the NetFlow v9 data flowset processor. In src/netflow_plugin/netflow_v9_collector.cpp, the Data template branch (lines 1695-1702) iterates over flow records without performing a per-iteration bounds check against the packet end pointer. In contrast, the Options template branch (lines 1709-1719) correctly checks 'if (pkt + offset + field_template->total_length > packet_end)' before each iteration. The Data branch omits this check entirely. Since template definitions are sent by the network peer (and are unauthenticated UDP), an attacker can craft templates that cause the parser to read arbitrary memory past the packet buffer. This can leak sensitive memory contents or cause a crash.
AnalysisAI
Out-of-bounds memory read in FastNetMon Community Edition through 1.2.9 exposes sensitive process memory and can crash the collector when processing crafted NetFlow v9 packets. The NetFlow v9 data flowset parser in src/netflow_plugin/netflow_v9_collector.cpp omits the per-iteration boundary check present in the sibling Options template branch, allowing a network-adjacent attacker who can deliver UDP NetFlow v9 packets to the collector to supply malicious template definitions that drive the parser past the end of the packet buffer. No public exploit code or confirmed active exploitation has been identified at time of analysis, but a security researcher blog post at lorikeetsecurity.com documents the code-level flaw, raising the disclosure surface.
Technical ContextAI
FastNetMon is an open-source high-performance DDoS detection tool that processes raw NetFlow v9 traffic. NetFlow v9 (RFC 3954) is a template-based flow export protocol transmitted over UDP - critically, template records that define field layouts are sent by the exporting network peer without any cryptographic authentication. The vulnerability is rooted in CWE-125 (Out-of-Bounds Read): in netflow_v9_collector.cpp the Options template branch correctly guards each field iteration with 'if (pkt + offset + field_template->total_length > packet_end)' before advancing, but the Data template branch (lines 1695-1702) lacks this per-iteration check entirely. Because template definitions originate from the network peer and are trusted implicitly, an attacker controlling what the collector receives can define templates with inflated field lengths that cause the loop to read arbitrarily beyond the allocated packet buffer into adjacent heap or stack memory. The CPE string provided by MITRE/NVD is listed as 'n/a' - affected product identification is derived from the description and upstream repository reference rather than a formally mapped CPE entry.
RemediationAI
No vendor-released patch version has been confirmed in the available data. The upstream repository at https://github.com/pavel-odintsov/fastnetmon should be monitored for a fix commit or tagged release that adds the missing per-iteration bounds check 'if (pkt + offset + field_template->total_length > packet_end)' to the Data template branch in netflow_v9_collector.cpp to mirror the correct logic already present in the Options template branch. Until a patch is available, defenders should restrict access to the FastNetMon NetFlow collection UDP port (typically 2055) using host-based firewall rules or network ACLs to allow only trusted, known NetFlow exporter IP addresses - this directly addresses the unauthenticated UDP template injection path. Organizations unable to restrict source IPs should consider temporarily disabling NetFlow v9 ingestion if alternatives such as sFlow or NetFlow v5 (which uses fixed-length records and lacks the template mechanism) are available, trading feature coverage for exposure reduction. Monitoring the lorikeetsecurity.com disclosure at https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48683-netflow-v9-data-oob may surface additional remediation guidance as the researcher disclosure matures.
LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutContr
Reachable assertion in Open5GS up to version 2.7.6 allows remote unauthenticated attackers to crash the Diameter CER han
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbi
Denial of service in Open5GS 2.7.6 and earlier allows network-adjacent attackers with low-privilege Diameter Gx peer acc
Denial of service in Open5GS HSS (Home Subscriber Server) versions 2.7.0 through 2.7.6 is triggered remotely by manipula
Remote command injection in Control Web Panel allows unauthenticated attackers to execute arbitrary OS commands as root
LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(
Remote code execution in dash-uploader (Python package for Plotly Dash) versions 0.1.0 through 0.7.0a2 allows unauthenti
Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr
SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg
Arbitrary file read in Yu AI Code Mother v4.3 lets anonymous, remote attackers retrieve files outside the intended previ
Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today