# CVE-2026-92695: FastNetMon out-of-bounds read in pcap packet parser

Source: https://junglewise.ai/threats/cve-2026-92695-fastnetmon-is-a-high-performance-ddos-detector-and-sensor-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-92695 · Severity: high · CVSS 8.2 · Published 2026-11-05

FastNetMon is a high-performance network traffic analyzer used to detect and mitigate DDoS attacks. When packet capture mode is enabled, the software crashes when processing truncated or malformed network frames without proper bounds checking. An attacker sending crafted packets across a monitored network segment causes denial of service and process termination.

Technologies: [Pavel-Odintsov Fastnetmon](https://junglewise.ai/threats/technologies/fastnetmon). Vendors: [Pavel-Odintsov](https://junglewise.ai/threats/vendors/pavel-odintsov).

## Quick answers

**Is CVE-2026-92695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92695 being exploited in the wild.

**How severe is CVE-2026-92695?** High severity, with a CVSS score of 8.2, published 5 November 2026.

**Which products and versions are affected?** Pavel-Odintsov Fastnetmon 1.2.9 and earlier.

**Is there a fix for CVE-2026-92695?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92695 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92695?** Check whether you run Pavel-Odintsov Fastnetmon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The parse_packet() callback in pcap_plugin/pcap_collector.cpp performs zero bounds checking against the actual captured frame length (packethdr->caplen). When processing IPv4 packets, an attacker-controlled IP header length field (IHL) combined with a short frame causes the parser to dereference IP and transport layer headers beyond the captured bytes, triggering an out-of-bounds read. This requires pcap mode enabled and network-accessible traffic on the monitored interface.

## Affected products

- Pavel Odintsov FastNetMon 1.2.9 and earlier

## Timeline

- 2026-07-20: disclosed
- 2026-11-05: advisory

## References

- [https://github.com/pavel-odintsov/fastnetmon/commit/5d0ee2d25fddb2db746ce4ce3326a589a2afef40](https://github.com/pavel-odintsov/fastnetmon/commit/5d0ee2d25fddb2db746ce4ce3326a589a2afef40)
- [https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-c27c-943r-vr8h](https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-c27c-943r-vr8h)

## Related threats

- [FastNetMon heap-use-after-free in NetFlow/IPFIX template cache](https://junglewise.ai/threats/cve-2026-93424-fastnetmon-is-a-high-performance-ddos-detector-and-sensor-in)
- [FastNetMon out-of-bounds read in sFlow parser](https://junglewise.ai/threats/cve-2026-92698-fastnetmon-is-a-high-performance-ddos-detector-and-sensor-in)