CVE-2026-93424

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, peer_find_template() in src/netflow_plugin/netflow_collector.cpp and src/netflow_plugin/netflow_v9_collector.cpp returns a pointer into global_netflow9_templates after releasing the cache mutex. On deployments with at least two entries in netflow_ports, concurrent template redefinition and data-flowset processing can let add_update_peer_template() reassign the template and free its records vector while another listener dereferences the escaped pointer. An unauthenticated sender that can reach both NetFlow/IPFIX listener ports can trigger a heap-use-after-free and reliably crash FastNetMon. No fixed release is available as of this review.

• CWE-416

• https://github.com/pavel-odintsov/fastnetmon/commit/a24e528d145b5371a7ab0bcdde23e4b4b99506e9
• https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv
• https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-ph88-95vc-x6gv

Published

Nov 5, 2026

Last Modified

Nov 10, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-93395A missing lower-bound validation in the bson_new_from_buffer…5.3
• CVE-2026-93399The Bookly plugin for WordPress is vulnerable to Insecure Di…9.1
• CVE-2026-93405Mailspring is a fast, cross-platform, open-source email clie…6.1
• CVE-2026-9341The Academy LMS – WordPress LMS Plugin for Complete eLearnin…4.3
• CVE-2026-9342A security flaw has been discovered in SourceCodester Hospit…6.3
• CVE-2026-93421Mesop is a Python-based UI framework that allows users to bu…5.3
• CVE-2026-93425Dokploy is a free, self-hostable Platform as a Service (PaaS…9.9
• CVE-2026-93426SigNoz versions 0.87.0 before 0.142.0 fail to escape user-su…8.5
• CVE-2026-93427The ARMember Premium – Membership Plugin, Content Restrictio…7.2
• CVE-2026-93428The Ultimate Member – User Profile, Registration, Login, Mem…7.5
• CVE-2026-93429The VikBooking Hotel Booking Engine & PMS plugin for WordPre…7.2
• CVE-2026-9343A weakness has been identified in Edimax EW-7438RPn up to 1.…6.3