Skip to content
OpenAdvisories
High · 7.5 CVE-2026-93424 EUVD-2026-117870

FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments

Published Nov 5, 2026 · Updated Nov 10, 2026 · Assigned by GitHub_M

Description

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review.

Affected products

VendorProductAffectedFixed
pavel-odintsov fastnetmon <= 1.2.9 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 fastnetmon No fix yet —
Debian 13 fastnetmon No fix yet —
Debian 12 fastnetmon No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 fastnetmon No fix yet —
Ubuntu 18.04 LTS fastnetmon No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 26.04 LTS fastnetmon No fix yet —
Ubuntu Pro 24.04 LTS fastnetmon No fix yet —
Ubuntu Pro 20.04 LTS fastnetmon No fix yet —

References