FastNetMon: several out-of-bounds reads and race conditions

The FastNetMon attack-detection server can be stopped by crafted packets.

Summary

FastNetMon 1.2.9 and earlier have out-of-bounds reads and race conditions in its packet collection and parsing paths. Servers receiving packets via sFlow, NetFlow or pcap are affected, and an unauthenticated remote attacker can crash the program with crafted packets.

Affected when

sFlow or NetFlow collection enabled
pcap capture mode enabled
networks_list includes an IPv6 range
two or more netflow_ports

What to do

No fixed version yet. Check that you run a version newer than 1.2.9 and read the vendor's advisory.

Products and platforms

FastNetMon

CVE IDs

Sources

Write-up: github.com (opens in a new tab)
CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)

Times

First published 2026-11-05 22:29 UTC

First seen 2026-11-09 17:20 UTC