[ CVE-2026-122127 · Published 4 Nov 2026 ]
Vulnerability in CESNET ipfixcol2
CVSS 7.5
No fix listed yet
[ Description ]Official description
CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompressed_size to write up to 65535 controlled bytes and crash the collector.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ References ]References
- github.com/CESNET/ipfixcol2
- github.com/CESNET/ipfixcol2/blob/v2.8.0/src/plugins/input/tcp/src/Lz4Decoder.cpp
- github.com/CESNET/ipfixcol2/commit/fd5cb168efb4b864d33f655174711b2779cef502
- github.com/CESNET/ipfixcol2/releases/tag/v2.9.0
- www.vulncheck.com/advisories/cesnet-ipfixcol2-2.7.1-before-2.9.0-heap-buffer-overflow-v…