{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/ipfixcol2--2.9.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cesnet:ipfixcol2:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-122130"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ipfixcol2 (\u003c 2.9.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["CESNET"],"content_html":"\u003cp\u003eCESNET ipfixcol2 versions 2.3.0 through 2.8.x are vulnerable to an integer overflow within the Forwarder output plugin. An unauthenticated attacker can send specially crafted IPFIX data sets and templates over TCP to the collector. The vulnerability stems from the wrapping of uint16_t message length counters, which results in a heap buffer overflow. This can be exploited to crash the collector service or potentially execute 2-byte writes to arbitrary memory addresses controlled by the attacker.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation may lead to a denial-of-service (crash) or arbitrary memory corruption via 2-byte writes to memory addresses influenced by the attacker.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade ipfixcol2 to version 2.9.0 or later to include the fix for the integer overflow in the Forwarder plugin.\u003c/li\u003e\n\u003cli\u003eUntil patching is possible, restrict access to the IPFIX collector TCP ports to trusted IPFIX exporters using firewall rules.\u003c/li\u003e\n\u003cli\u003eMonitor logs for repeated collector service crashes or restarts that coincide with incoming IPFIX traffic.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-04T22:07:43Z","date_published":"2026-11-04T22:07:43Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cesnet-ipfixcol2/","summary":"An integer overflow vulnerability in the CESNET ipfixcol2 Forwarder output plugin allows unauthenticated remote attackers to trigger heap memory corruption via crafted IPFIX messages.","title":"CESNET ipfixcol2: Heap buffer overflow in Forwarder output plugin (CVE-2026-122130)","url":"https://feed.craftedsignal.io/briefs/2026-11-cesnet-ipfixcol2/"}],"language":"en","title":"CraftedSignal Threat Feed - Ipfixcol2 (\u003c 2.9.0)","version":"https://jsonfeed.org/version/1.1"}