Executive brief
FastNetMon Community Edition, a DDoS detection and mitigation tool, contains a flaw in how it processes network routing information (BGP). An attacker can send specially crafted routing updates that cause the software to misinterpret network data, potentially leading to service crashes or incorrect security decisions. This could allow an attacker to bypass DDoS protections or disrupt the monitoring of network traffic.
Technical details
A vulnerability exists in the `parse_raw_bgp_attribute()` function within `src/bgp_protocol.hpp`. While the parser correctly identifies the 'Extended Length' bit (indicating a 2-byte length field per RFC 4271), it only reads a single byte to determine the attribute value length. This results in length truncation for any attribute exceeding 255 bytes. The remaining bytes are then misinterpreted as subsequent attributes, causing cascading parse failures, 'phantom' attributes, and potential out-of-bounds memory reads. The vulnerability is reachable via BGP updates forwarded from an external daemon like GoBGP. As of May 2026, no official patch has been released.
Affected products
- FastNetMon FastNetMon Community Edition through 1.2.9
Timeline
- 2026-04-25: disclosed: Lorikeet Security notified FastNetMon LTD
- 2026-05-23: advisory: Lorikeet Security published detailed advisory
- 2026-05-26: disclosed: CVE-2026-48685 published to NVD