pavel-odintsov FastNetMon up to 1.2.9 Nested Parser sflow_collector.cpp process_sflow_flow_sample header_size out-of-bounds

Summaryinfo

A vulnerability marked as critical has been reported in pavel-odintsov FastNetMon up to 1.2.9. The affected element is the function process_sflow_flow_sample of the file src/sflow_plugin/sflow_collector.cpp of the component Nested Parser. This manipulation of the argument header_size causes out-of-bounds. This vulnerability is handled as CVE-2026-92698. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in pavel-odintsov FastNetMon up to 1.2.9. It has been declared as critical. Affected by this vulnerability is the function process_sflow_flow_sample of the file src/sflow_plugin/sflow_collector.cpp of the component Nested Parser. The manipulation of the argument header_size with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-92698 since 09/16/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 11/05/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• pavel-odintsov

Name

• FastNetMon

Version

• 1.2.0
• 1.2.1
• 1.2.2
• 1.2.3
• 1.2.4
• 1.2.5
• 1.2.6
• 1.2.7
• 1.2.8
• 1.2.9

Website

• Product: https://github.com/pavel-odintsov/fastnetmon/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion