DEBIAN-CVE-2026-92693

    Dashboard / Vulnerabilities / DEBIAN-CVE-2026-92693

    DEBIAN-CVE-2026-92693

    Published: 5 Nov 2026Last Modified: 7 Nov 2026
    Upstream:
    CVE-2026-92693

    Summary:

    Details: FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, parse_raw_packet_to_simple_packet_full() in src/simple_packet_parser_ng.cpp dereferences ipv6_extension_header_fragment_t when IpProtocolNumberIPV6_FRAG is present without first verifying that the eight-byte Fragment header remains. A crafted sFlow v5 RAW_PACKET_HEADER record can remotely reach this shared parser with the Fragment bytes omitted, causing an unauthenticated remote out-of-bounds read. The supplied harness detects the read under AddressSanitizer, but the advisory does not establish a production process crash. No fixed release is available as of this review.

    References: https://security-tracker.debian.org/tracker/CVE-2026-92693

    Affected packages

    Package

    Name: fastnetmon

    Purl: pkg:deb/debian/fastnetmon?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.2.4-2
    1.2.4-2+deb12u1
    1.2.5-1
    1.2.5-2
    1.2.5-2~bpo12+1
    1.2.6-1
    1.2.6-1~bpo12+1
    1.2.7-1
    1.2.7-1~bpo12+1
    1.2.8+git20250911-1
    1.2.8+git20250911-2
    1.2.8-1
    1.2.8-1~bpo12+1
    1.2.9-1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2026-92693 | CVE-DB