Description
CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| CESNET | ipfixcol2 | 2.7.1 – < 2.9.0 | 2.9.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ipfixcol2 | 2.9.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | ipfixcol2 | No fix yet | — |
References
- Patch Commit patch
- https://github.com/CESNET/ipfixcol2 product
- ipfixcol2 v2.9.0 Release Notes release-notes
- https://github.com/CESNET/ipfixcol2/blob/v2.8.0/src/plugins/input/tcp/src/Lz4Decoder.cpp#L126-L131 technical-description
- VulnCheck Advisory: CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder third-party-advisory