Executive brief
FastNetMon is a high-performance DDoS sensor used to monitor network traffic and detect attacks. A vulnerability in its internal data handling allows a remote attacker to send specially crafted network traffic (such as BGP or NetFlow data) to crash the service or potentially take full control of the server. This could lead to a complete loss of network monitoring capabilities and unauthorized access to sensitive infrastructure.
Technical details
An off-by-one heap-based buffer overflow exists in the dynamic_binary_buffer_t class within src/dynamic_binary_buffer.hpp. Five methods (append_dynamic_buffer, append_data_as_pointer, append_data_as_object_ptr, memcpy_from_ptr, and memcpy_from_object_ptr) utilize an incorrect bounds check of 'if (offset + length > maximum_internal_storage_size + 1)' instead of the correct 'if (offset + length > maximum_internal_storage_size)'. This flaw allows an attacker to write exactly one byte past the end of a heap-allocated buffer. The affected class is used extensively for BGP message encoding, NetFlow template processing, and Flow Spec NLRI construction. A remote, unauthenticated attacker can trigger this overflow by sending malicious NetFlow, sFlow, IPFIX, or BGP traffic, potentially leading to arbitrary code execution via heap metadata corruption (e.g., House of Einherjar or tcache-related techniques).
Affected products
- FastNetMon FastNetMon Community Edition through 1.2.9
Timeline
- 2026-05-23: disclosed: Vulnerability details published by Lorikeet Security
- 2026-05-26: advisory: CVE-2026-48689 assigned and published to NVD