Is CVE-2026-122129 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-122129 being exploited in the wild.

How severe is CVE-2026-122129?

Medium severity, with a CVSS score of 5.3, published 4 November 2026.

Which products and versions are affected?

CESNET Ipfixcol2 2.7.1 before 2.9.0.

Is there a fix for CVE-2026-122129?

Yes: fixed in 2.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-122129 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-122129?

Check whether you run CESNET Ipfixcol2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-122129: CESNET ipfixcol2 memory exhaustion in LZ4 decoder

CVE-2026-122129 · Severity: medium · CVSS 5.3 · Published 2026-11-04

CESNET ipfixcol2 is a high-performance network flow collector that receives and processes NetFlow and IPFIX traffic data. An unauthenticated attacker can open TCP connections and send specially crafted LZ4 compression headers with extremely large buffer sizes, forcing the collector to allocate up to 4 GiB of memory per connection. This causes the collector to run out of memory and stop processing legitimate network traffic.

Technologies: CESNET Ipfixcol2. Vendors: CESNET.

Quick answers

Is CVE-2026-122129 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-122129 being exploited in the wild.
How severe is CVE-2026-122129?: Medium severity, with a CVSS score of 5.3, published 4 November 2026.
Which products and versions are affected?: CESNET Ipfixcol2 2.7.1 before 2.9.0.
Is there a fix for CVE-2026-122129?: Yes: fixed in 2.9.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-122129 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-122129?: Check whether you run CESNET Ipfixcol2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.9.0

Technical details

The vulnerability exists in the Lz4Decoder::read_start_header() function, which reads an LZ4 start header containing a buffer_size field without validation. An attacker can send a TCP connection with an unbounded buffer_size value, causing the reset_stream() function to allocate excessive memory for the decompression ring buffer. An unauthenticated network attacker can trigger this by opening multiple connections, each declaring multi-gigabyte allocations, leading to denial of service.

Affected products

CESNET ipfixcol2 2.7.1 before 2.9.0

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.