Executive brief
FastNetMon Community Edition, a high-performance DDoS sensor used to monitor network traffic, contains a vulnerability in how it processes NetFlow v9 metadata. An attacker can send a specially crafted network packet that causes the software to read memory outside of its intended boundaries. This can lead to a service outage (denial of service) by crashing the monitoring daemon or potentially allow an attacker to view sensitive information stored in the system's memory.
Technical details
An out-of-bounds read exists in the process_netflow_v9_options_template() function within src/netflow_plugin/netflow_v9_collector.cpp. The vulnerability is caused by a lack of bounds checking in two loops (scope parsing and options parsing) that iterate based on attacker-controlled length fields (option_scope_length and option_length). An attacker can provide inflated length values that cause the parser to read past the end of the UDP packet buffer. Additionally, a lack of alignment validation can cause misaligned reads, leading to crashes on certain architectures. This is a single-packet, unauthenticated attack reachable via the default NetFlow port (UDP 2055).
Affected products
- FastNetMon LTD FastNetMon Community Edition through 1.2.9
Timeline
- 2026-04-25: disclosed: Lorikeet Security notified FastNetMon LTD
- 2026-05-26: advisory: CVE-2026-48684 published by NVD/MITRE