Is CVE-2026-93424 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-93424 being exploited in the wild.

How severe is CVE-2026-93424?

High severity, with a CVSS score of 7.5, published 5 November 2026.

Which products and versions are affected?

Pavel-Odintsov Fastnetmon 1.2.9 and earlier.

Is there a fix for CVE-2026-93424?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-93424 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-93424?

Check whether you run Pavel-Odintsov Fastnetmon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-93424: FastNetMon heap-use-after-free in NetFlow/IPFIX template cache

CVE-2026-93424 · Severity: high · CVSS 7.5 · Published 2026-11-05

FastNetMon is a high-performance DDoS detection system that processes network flow data from multiple sources. A flaw in its NetFlow/IPFIX template caching mechanism allows an unauthenticated attacker sending specially crafted packets to both listener ports to trigger a heap-use-after-free condition, reliably crashing the FastNetMon process and disrupting DDoS protection. On deployments with multiple NetFlow listener ports (a standard configuration), this can be exploited within seconds.

Technologies: Pavel-Odintsov Fastnetmon. Vendors: Pavel-Odintsov.

Quick answers

Is CVE-2026-93424 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-93424 being exploited in the wild.
How severe is CVE-2026-93424?: High severity, with a CVSS score of 7.5, published 5 November 2026.
Which products and versions are affected?: Pavel-Odintsov Fastnetmon 1.2.9 and earlier.
Is there a fix for CVE-2026-93424?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-93424 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-93424?: Check whether you run Pavel-Odintsov Fastnetmon at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a heap-use-after-free in peer_find_template() in the NetFlow v9/IPFIX collector modules. The function returns a pointer into the global template cache after releasing the mutex protecting it, but callers dereference this pointer (specifically the records vector) without holding a lock. On multi-port deployments, concurrent threads racing between add_update_peer_template() reassigning and reallocating template records and netflow9_flowset_to_store() reading those records triggers the use-after-free. An unauthenticated remote attacker on the network path can craft NetFlow packets with matching template IDs and source IDs across two listener ports to reliably trigger the crash.

Affected products

Pavel Odintsov FastNetMon 1.2.9 and earlier

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.