Ipfixcol2 (< 2.9.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ipfixcol2--2.9.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 04 Nov 2026 22:07:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCESNET ipfixcol2: Heap buffer overflow in Forwarder output plugin (CVE-2026-122130)https://feed.craftedsignal.io/briefs/2026-11-cesnet-ipfixcol2/Wed, 04 Nov 2026 22:07:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cesnet-ipfixcol2/An integer overflow vulnerability in the CESNET ipfixcol2 Forwarder output plugin allows unauthenticated remote attackers to trigger heap memory corruption via crafted IPFIX messages.CESNET ipfixcol2 versions 2.3.0 through 2.8.x are vulnerable to an integer overflow within the Forwarder output plugin. An unauthenticated attacker can send specially crafted IPFIX data sets and templates over TCP to the collector. The vulnerability stems from the wrapping of uint16_t message length counters, which results in a heap buffer overflow. This can be exploited to crash the collector service or potentially execute 2-byte writes to arbitrary memory addresses controlled by the attacker.

Impact

Successful exploitation may lead to a denial-of-service (crash) or arbitrary memory corruption via 2-byte writes to memory addresses influenced by the attacker.

Recommendation

  • Upgrade ipfixcol2 to version 2.9.0 or later to include the fix for the integer overflow in the Forwarder plugin.
  • Until patching is possible, restrict access to the IPFIX collector TCP ports to trusted IPFIX exporters using firewall rules.
  • Monitor logs for repeated collector service crashes or restarts that coincide with incoming IPFIX traffic.
]]>highadvisory