ubuntu-cve-2026-48684
Vulnerability from osv_ubuntu
Published
2026-05-26 16:16
Modified
2026-06-15 18:15
Summary
Details

FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser. In process_netflow_v9_options_template() (src/netflow_plugin/netflow_v9_collector.cpp), the scope parsing loop (lines 224-229) iterates until scopes_offset reaches the attacker-controlled option_scope_length value, reading netflow9_template_flowset_record_t structures at each step. No bounds check validates that (zone_address + scopes_offset + sizeof(record)) stays within the flowset. The same issue affects the options field loop (lines 241-257) with option_length. Furthermore, option_scope_length is not validated to be a multiple of sizeof(netflow9_template_flowset_record_t), potentially causing misaligned reads. An attacker can trigger reads past the end of the UDP packet buffer.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
N/A (UNKNOWN)
medium
References
To clipboard 

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "fastnetmon",
            "binary_version": "1.1.3+dfsg-6build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "fastnetmon",
        "purl": "pkg:deb/ubuntu/fastnetmon@1.1.3+dfsg-6build1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.1.3+dfsg-3",
        "1.1.3+dfsg-4",
        "1.1.3+dfsg-6build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "fastnetmon",
            "binary_version": "1.1.4-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "fastnetmon",
        "purl": "pkg:deb/ubuntu/fastnetmon@1.1.4-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.1.4-1",
        "1.1.4-1build3",
        "1.1.4-1build4",
        "1.1.4-1build5",
        "1.1.4-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "fastnetmon",
            "binary_version": "1.2.6-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:24.04:LTS",
        "name": "fastnetmon",
        "purl": "pkg:deb/ubuntu/fastnetmon@1.2.6-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.5-1",
        "1.2.6-1",
        "1.2.6-1build1",
        "1.2.6-1build2",
        "1.2.6-1build3",
        "1.2.6-1build4",
        "1.2.6-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "fastnetmon",
            "binary_version": "1.2.8+git20250911-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "fastnetmon",
        "purl": "pkg:deb/ubuntu/fastnetmon@1.2.8+git20250911-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.8-1build1",
        "1.2.8-1build2",
        "1.2.8+git20250911-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "fastnetmon",
            "binary_version": "1.2.8+git20250911-2ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:26.04:LTS",
        "name": "fastnetmon",
        "purl": "pkg:deb/ubuntu/fastnetmon@1.2.8+git20250911-2ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.8+git20250911-1",
        "1.2.8+git20250911-1build1",
        "1.2.8+git20250911-1build2",
        "1.2.8+git20250911-2",
        "1.2.8+git20250911-2ubuntu0.1~esm1"
      ]
    }
  ],
  "aliases": [],
  "details": "FastNetMon Community Edition through 1.2.9 contains an out-of-bounds read in the NetFlow v9 options template parser. In process_netflow_v9_options_template() (src/netflow_plugin/netflow_v9_collector.cpp), the scope parsing loop (lines 224-229) iterates until scopes_offset reaches the attacker-controlled option_scope_length value, reading netflow9_template_flowset_record_t structures at each step. No bounds check validates that (zone_address + scopes_offset + sizeof(record)) stays within the flowset. The same issue affects the options field loop (lines 241-257) with option_length. Furthermore, option_scope_length is not validated to be a multiple of sizeof(netflow9_template_flowset_record_t), potentially causing misaligned reads. An attacker can trigger reads past the end of the UDP packet buffer.",
  "id": "UBUNTU-CVE-2026-48684",
  "modified": "2026-06-15T18:15:28Z",
  "published": "2026-05-26T16:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-48684"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-48684"
    },
    {
      "type": "REPORT",
      "url": "https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48684-netflow-v9-options-oob"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/pavel-odintsov/fastnetmon/commit/aa1069abaa8624e50b5d0c6c8ccd0f5d9ddc111e"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/pavel-odintsov/fastnetmon/pull/1057"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/pavel-odintsov/fastnetmon"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/pavel-odintsov/fastnetmon/blob/master/src/netflow_plugin/netflow_v9_collector.cpp"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-48684"
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.