Search

Find a vulnerability

Search criteria

    6 vulnerabilities found for ipfixcol2 by CESNET

    CVE-2026-122130 (GCVE-0-2026-122130)

    Vulnerability from nvd – Published: 2026-11-04 20:36 – Updated: 2026-11-04 20:36
    VLAI
    Title
    CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin
    Summary
    CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.
    Severity
    8.3 (High)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
    8.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
    CWE
    • CWE-190 - Integer Overflow or Wraparound
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7402 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    CESNET ipfixcol2 Affected: 2.3.0 , < 2.9.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-16 00:00
    Credits
    Deus Rex Michal Sedlak
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ipfixcol2",
          "vendor": "CESNET",
          "versions": [
            {
              "lessThan": "2.9.0",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Deus Rex"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Michal Sedlak"
        }
      ],
      "datePublic": "2026-10-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:50.335Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/commit/ad206f6217257b06b139f1b2bce50d52f5bc6acb"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/CESNET/ipfixcol2"
        },
        {
          "name": "ipfixcol2 v2.9.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/releases/tag/v2.9.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/blob/v2.8.0/src/plugins/output/forwarder/src/Message.cpp#L134-L156"
        },
        {
          "name": "VulnCheck Advisory: CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cesnet-ipfixcol2-2.3.0-before-2.9.0-buffer-overflow-via-forwarder-output-plugin"
        }
      ],
      "title": "CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-122130",
    "datePublished": "2026-11-04T20:36:50.335Z",
    "dateReserved": "2026-11-04T18:13:10.475Z",
    "dateUpdated": "2026-11-04T20:36:50.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-122129 (GCVE-0-2026-122129)

    Vulnerability from nvd – Published: 2026-11-04 20:36 – Updated: 2026-11-04 20:36
    VLAI
    Title
    CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder
    Summary
    CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
    CWE
    • CWE-789 - Memory Allocation with Excessive Size Value
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7402 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    CESNET ipfixcol2 Affected: 2.7.1 , < 2.9.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-14 00:00
    Credits
    Deus Rex Michal Sedlak
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ipfixcol2",
          "vendor": "CESNET",
          "versions": [
            {
              "lessThan": "2.9.0",
              "status": "affected",
              "version": "2.7.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Deus Rex"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Michal Sedlak"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:49.660Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/commit/1a199033eff847941353c5c039cb806a9ad8aa6f"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/CESNET/ipfixcol2"
        },
        {
          "name": "ipfixcol2 v2.9.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/releases/tag/v2.9.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/blob/v2.8.0/src/plugins/input/tcp/src/Lz4Decoder.cpp#L126-L131"
        },
        {
          "name": "VulnCheck Advisory: CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cesnet-ipfixcol2-2.7.1-before-2.9.0-memory-exhaustion-via-tcp-lz4-decoder"
        }
      ],
      "title": "CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-122129",
    "datePublished": "2026-11-04T20:36:49.660Z",
    "dateReserved": "2026-11-04T18:13:10.127Z",
    "dateUpdated": "2026-11-04T20:36:49.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-122127 (GCVE-0-2026-122127)

    Vulnerability from nvd – Published: 2026-11-04 20:36 – Updated: 2026-11-04 20:36
    VLAI
    Title
    CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder
    Summary
    CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled bytes and crash the collector.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    CWE
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7402 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    CESNET ipfixcol2 Affected: 2.7.1 , < 2.9.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-14 00:00
    Credits
    Deus Rex Michal Sedlak
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ipfixcol2",
          "vendor": "CESNET",
          "versions": [
            {
              "lessThan": "2.9.0",
              "status": "affected",
              "version": "2.7.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Deus Rex"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Michal Sedlak"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled bytes and crash the collector."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:48.956Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/commit/fd5cb168efb4b864d33f655174711b2779cef502"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/CESNET/ipfixcol2"
        },
        {
          "name": "ipfixcol2 v2.9.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/releases/tag/v2.9.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/blob/v2.8.0/src/plugins/input/tcp/src/Lz4Decoder.cpp#L139-L151"
        },
        {
          "name": "VulnCheck Advisory: CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cesnet-ipfixcol2-2.7.1-before-2.9.0-heap-buffer-overflow-via-tcp-lz4-decoder"
        }
      ],
      "title": "CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-122127",
    "datePublished": "2026-11-04T20:36:48.956Z",
    "dateReserved": "2026-11-04T18:13:09.783Z",
    "dateUpdated": "2026-11-04T20:36:48.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-122130 (GCVE-0-2026-122130)

    Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-04 20:36
    VLAI
    Title
    CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin
    Summary
    CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.
    Severity
    8.3 (High)
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
    8.2 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
    CWE
    • CWE-190 - Integer Overflow or Wraparound
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7402 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    CESNET ipfixcol2 Affected: 2.3.0 , < 2.9.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-16 00:00
    Credits
    Deus Rex Michal Sedlak
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ipfixcol2",
          "vendor": "CESNET",
          "versions": [
            {
              "lessThan": "2.9.0",
              "status": "affected",
              "version": "2.3.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Deus Rex"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Michal Sedlak"
        }
      ],
      "datePublic": "2026-10-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:50.335Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/commit/ad206f6217257b06b139f1b2bce50d52f5bc6acb"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/CESNET/ipfixcol2"
        },
        {
          "name": "ipfixcol2 v2.9.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/releases/tag/v2.9.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/blob/v2.8.0/src/plugins/output/forwarder/src/Message.cpp#L134-L156"
        },
        {
          "name": "VulnCheck Advisory: CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cesnet-ipfixcol2-2.3.0-before-2.9.0-buffer-overflow-via-forwarder-output-plugin"
        }
      ],
      "title": "CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-122130",
    "datePublished": "2026-11-04T20:36:50.335Z",
    "dateReserved": "2026-11-04T18:13:10.475Z",
    "dateUpdated": "2026-11-04T20:36:50.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-122129 (GCVE-0-2026-122129)

    Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-04 20:36
    VLAI
    Title
    CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder
    Summary
    CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service.
    Severity
    6.9 (Medium)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
    5.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
    CWE
    • CWE-789 - Memory Allocation with Excessive Size Value
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7402 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    CESNET ipfixcol2 Affected: 2.7.1 , < 2.9.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-14 00:00
    Credits
    Deus Rex Michal Sedlak
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ipfixcol2",
          "vendor": "CESNET",
          "versions": [
            {
              "lessThan": "2.9.0",
              "status": "affected",
              "version": "2.7.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Deus Rex"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Michal Sedlak"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-789",
              "description": "Memory Allocation with Excessive Size Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:49.660Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/commit/1a199033eff847941353c5c039cb806a9ad8aa6f"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/CESNET/ipfixcol2"
        },
        {
          "name": "ipfixcol2 v2.9.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/releases/tag/v2.9.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/blob/v2.8.0/src/plugins/input/tcp/src/Lz4Decoder.cpp#L126-L131"
        },
        {
          "name": "VulnCheck Advisory: CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cesnet-ipfixcol2-2.7.1-before-2.9.0-memory-exhaustion-via-tcp-lz4-decoder"
        }
      ],
      "title": "CESNET ipfixcol2 2.7.1 before 2.9.0 Memory Exhaustion via TCP LZ4 Decoder",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-122129",
    "datePublished": "2026-11-04T20:36:49.660Z",
    "dateReserved": "2026-11-04T18:13:10.127Z",
    "dateUpdated": "2026-11-04T20:36:49.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-122127 (GCVE-0-2026-122127)

    Vulnerability from cvelistv5 – Published: 2026-11-04 20:36 – Updated: 2026-11-04 20:36
    VLAI
    Title
    CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder
    Summary
    CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled bytes and crash the collector.
    Severity
    8.7 (High)
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
    7.5 (High)
    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
    CWE
    Assigner
    VulnCheck CNA under the mitre root
    CNA scorecard B 84/100 over 7402 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    CESNET ipfixcol2 Affected: 2.7.1 , < 2.9.0 (semver)
    		Create a notification for this product.
    Date Public
    2026-10-14 00:00
    Credits
    Deus Rex Michal Sedlak
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ipfixcol2",
          "vendor": "CESNET",
          "versions": [
            {
              "lessThan": "2.9.0",
              "status": "affected",
              "version": "2.7.1",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Deus Rex"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Michal Sedlak"
        }
      ],
      "datePublic": "2026-10-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled bytes and crash the collector."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T20:36:48.956Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/commit/fd5cb168efb4b864d33f655174711b2779cef502"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/CESNET/ipfixcol2"
        },
        {
          "name": "ipfixcol2 v2.9.0 Release Notes",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/releases/tag/v2.9.0"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/CESNET/ipfixcol2/blob/v2.8.0/src/plugins/input/tcp/src/Lz4Decoder.cpp#L139-L151"
        },
        {
          "name": "VulnCheck Advisory: CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/cesnet-ipfixcol2-2.7.1-before-2.9.0-heap-buffer-overflow-via-tcp-lz4-decoder"
        }
      ],
      "title": "CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-122127",
    "datePublished": "2026-11-04T20:36:48.956Z",
    "dateReserved": "2026-11-04T18:13:09.783Z",
    "dateUpdated": "2026-11-04T20:36:48.956Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}