CVE-2026-122130 in ipfixcol2
Summary
by MITRE • 11/04/2026
CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified in CESNET ipfixcol versions prior to 2.9.0 represents a critical security flaw within the Forwarder output plugin, specifically affecting systems configured to forward IPFIX data over TCP connections. This integer overflow issue stems from an improper handling of message length counters that are defined as unsigned sixteen-bit integers (uint16_t). In network protocol implementations, particularly those dealing with flow telemetry like Internet Protocol Flow Information Exporting or IPFIX, the accurate calculation and validation of payload sizes are paramount for maintaining system stability. When ipfixcol processes incoming data from unauthenticated exporters, it fails to adequately validate whether the sum of message components exceeds the maximum value representable by a uint16_t variable, which is 65535 bytes. This lack of boundary checking allows an attacker to manipulate internal state variables through carefully crafted inputs that trigger arithmetic wrapping rather than raising an appropriate error or truncating the input safely.
From a technical perspective, this flaw enables heap buffer overflow conditions when the collector attempts to allocate memory based on the wrapped length value. An adversary can exploit this by sending data sets with lengths near 65535 bytes combined with large template definitions that cause the internal counter to wrap around to a small positive number. Consequently, the system allocates a significantly smaller heap buffer than required for the actual payload size. When the application proceeds to write the full-sized data into this undersized allocation, it overwrites adjacent memory regions on the heap. This out-of-bounds write operation corrupts critical metadata structures such as free chunks or linked list pointers within the heap allocator. The ability to perform two-byte writes to attacker-influenced addresses provides a potent primitive for further exploitation, potentially leading to arbitrary code execution if combined with other techniques like heap spraying or specific memory layout manipulation, although in this instance, immediate denial of service is also a highly probable outcome due to the corruption of internal state required for normal operation.
The operational impact of this vulnerability is severe, primarily manifesting as a remote denial of service against IPFIX collectors that have forwarding enabled over TCP. Since the flaw allows unauthenticated attackers to trigger these conditions, any system exposing an ipfixcol instance with forwarder capabilities on a network interface accessible by potential adversaries is at risk. The immediate consequence of exploitation is typically a crash or segmentation fault within the collector process, resulting in the loss of telemetry data and requiring manual intervention to restart services. Beyond availability issues, the underlying memory corruption poses a latent threat for privilege escalation or remote code execution if an attacker can control additional aspects of the heap layout during the overflow event. This makes the vulnerability not just a nuisance but a significant risk vector against infrastructure monitoring systems that rely on continuous data ingestion and forwarding.
Mitigation strategies should prioritize immediate patching to version 2.9.0 or later, where this integer overflow has been addressed through proper validation of message lengths before allocation and processing. In environments where upgrading is not immediately feasible, network-level controls such as access control lists can be implemented to restrict TCP connections from untrusted sources to the ipfixcol forwarder ports. Additionally, deploying intrusion detection systems capable of identifying anomalous IPFIX packet sizes or patterns consistent with integer overflow attempts may provide a layer of defense in depth. It is also advisable to review configuration settings to disable forwarding if it is not strictly necessary for the operational workflow, thereby reducing the attack surface exposed to unauthenticated exporters. Regular auditing of third-party component versions and adherence to software supply chain security practices are essential to prevent similar vulnerabilities from impacting critical monitoring infrastructure. This vulnerability aligns with CWE-190 (Integer Overflow or Wraparound) as defined by Common Weakness Enumeration and can be categorized under ATT&CK techniques related to resource exhaustion for denial of service, specifically T1498 Network Denial of Service if the primary goal is disruption, though the memory corruption aspect suggests potential alignment with exploitation primitives found in advanced persistent threat campaigns.