CVE-2026-122129 in ipfixcol2
Summary
by MITRE • 11/04/2026
CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in CESNET ipfixcol2 versions prior to 2.9.0 represents a critical resource exhaustion flaw rooted in the Lz4Decoder::read_start_header() function. This component is responsible for parsing incoming data streams that utilize LZ4 compression, a common technique for optimizing network traffic efficiency within IPFIX flow collection systems. The core technical deficiency lies in the absence of strict upper bounds when validating ring buffer size declarations received from remote peers. When an unauthenticated attacker establishes a TCP connection and transmits an LZ4 start header containing an excessively large or malformed buffer size value, the application fails to perform adequate sanity checks before proceeding with memory operations. Consequently, the system attempts to allocate memory corresponding directly to this unbounded input value without verifying whether it falls within acceptable operational limits for the host environment.
This lack of validation allows malicious actors to trigger massive memory allocations on a per-connection basis. Specifically, an attacker can force the ipfixcol2 collector service to attempt allocating up to 4 GiB of RAM for each individual connection established against the vulnerable endpoint. This behavior is particularly dangerous because it does not require authentication or complex exploitation techniques beyond establishing a network socket and sending specific crafted headers. The immediate operational impact is severe, as the rapid consumption of available system memory leads directly to resource exhaustion. As the operating system struggles to satisfy these large allocation requests, overall system performance degrades rapidly, potentially causing other critical services running on the same host to fail due to lack of resources or triggering out-of-memory killers that terminate essential processes unpredictably.
From a security classification perspective, this vulnerability aligns with CWE-789: Memory Allocation with Uncontrolled Input Size and CWE-400: Uncontrolled Resource Consumption. The attack vector is classified under MITRE ATT&CK technique T1496: Resource Hijacking, specifically manifesting as Denial of Service through resource exhaustion. By leveraging this flaw, an adversary can effectively deny service to legitimate IPFIX collectors, disrupting network monitoring, security analytics, and traffic accounting capabilities that rely on the continuous operation of these data collection agents. The impact extends beyond simple downtime; it compromises the availability pillar of the CIA triad for any infrastructure dependent on uninterrupted flow data ingestion.
To mitigate this vulnerability, organizations must upgrade ipfixcol2 to version 2.9.0 or later, where the developers have implemented proper input validation and size constraints within the Lz4Decoder module. Until an update can be applied, defensive measures should include deploying network-level access control lists to restrict TCP connections from untrusted sources to port ranges used by ipfixcol2. Additionally, implementing rate limiting on incoming connections can help mitigate the speed at which memory is consumed during such attacks. System administrators should also monitor system memory usage and connection counts closely for anomalies that may indicate ongoing exploitation attempts, ensuring rapid detection and response capabilities are in place to maintain service availability against resource exhaustion threats.