Executive brief
FastNetMon Community Edition, a tool used by network operators to detect and mitigate DDoS attacks, contains a flaw in how it processes incoming network traffic. An attacker can send specially crafted network packets that cause the software to read memory outside of the intended area or misinterpret packet data. This can lead to the software crashing (denial of service), the leakage of sensitive information from the system's memory into monitoring logs, or the corruption of network traffic statistics.
Technical details
An out-of-bounds read exists in `src/simple_packet_parser_ng.cpp` within the IPv4 packet parsing logic. The parser validates that a packet is at least 20 bytes (the minimum IPv4 header size) but fails to verify that the Internet Header Length (IHL) field is valid (>= 5) or that the buffer contains enough data to satisfy the length specified by IHL (up to 60 bytes). If IHL is set to 15, the parser advances 40 bytes beyond the validated 20-byte buffer, leading to an OOB read of heap or stack memory. If IHL is less than 5, the pointer fails to advance past the IP header, causing subsequent Layer 4 (TCP/UDP) parsing to occur on the IP header itself (type confusion). This is reachable via any packet capture interface (sFlow, NetFlow, PCAP) and can result in DoS, information disclosure via exported flow records, or corrupted telemetry.
Affected products
- Pavel Odintsov FastNetMon Community Edition through 1.2.9
Timeline
- 2026-04-25: disclosed: Reported to vendor by Lorikeet Security
- 2026-05-23: advisory: Public advisory released by Lorikeet Security
- 2026-06-02: disclosed: CVE published to NVD