Heap Vulnerability in FastNetMon DDoS Detector for Enhanced Security
CVE-2026-93424

7.5HIGH

Key Information:

Vendor

Pavel-odintsov

Status
Fastnetmon
Vendor
CVE Published:
5 November 2026

What is CVE-2026-93424?

FastNetMon, a high-performance DDoS detection service, suffers from a heap-use-after-free vulnerability in versions 1.2.9 and earlier. The issue arises from improper management of cache mutexes, which may allow an unauthenticated attacker to exploit concurrent processing of NetFlow/IPFIX data. This can lead to the dereferencing of a freed pointer, resulting in a reliable crash of the FastNetMon service. Currently, there is no available fix for this vulnerability, emphasizing the need for users to carefully monitor their deployments and implement security measures to mitigate potential exploits.

Affected Version(s)

fastnetmon <= 1.2.9

References

https://github.com/pavel-odintsov/fastnetmon/security/adv...
x_refsource_CONFIRM
https://github.com/pavel-odintsov/fastnetmon/commit/a24e5...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.