Description
CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled bytes and crash the collector.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CESNET | ipfixcol2 | 2.7.1 – < 2.9.0 | 2.9.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ipfixcol2 | 2.9.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ipfixcol2 | No fix yet | — |
References
- Patch Commit patch
- https://github.com/CESNET/ipfixcol2 product
- ipfixcol2 v2.9.0 Release Notes release-notes
- https://github.com/CESNET/ipfixcol2/blob/v2.8.0/src/plugins/input/tcp/src/Lz4Decoder.cpp#L139-L151 technical-description
- VulnCheck Advisory: CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder third-party-advisory