Skip to content
OpenAdvisories
High · 8.2 CVE-2026-92695 EUVD-2026-117833

FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated frames

Published Nov 5, 2026 · Updated Nov 10, 2026 · Assigned by GitHub_M

Description

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the live parse_packet() callback in src/pcap_plugin/pcap_collector.cpp is registered through pcap_loop and processes captured frames when pcap = on without checking packethdr->caplen. A short frame or an attacker-controlled IPv4 header length can make the parser dereference IP or transport headers beyond the captured bytes, causing an out-of-bounds read and process termination. No fixed release is available as of this review.

Affected products

VendorProductAffectedFixed
pavel-odintsov fastnetmon <= 1.2.9 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 fastnetmon No fix yet —
Debian 13 fastnetmon No fix yet —
Debian 12 fastnetmon No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 fastnetmon No fix yet —
Ubuntu 18.04 LTS fastnetmon No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS fastnetmon No fix yet —
Ubuntu Pro 24.04 LTS fastnetmon No fix yet —
Ubuntu Pro 20.04 LTS fastnetmon No fix yet —

References