CVE-2026-48691 Details
Description
FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4UnicastAnnounce::get_attributes() function computes attribute_length as 'sizeof(bgp_as_path_segment_element_t) + this->as_path_asns.size() * sizeof(uint32_t)' and stores it in a uint8_t field (line 600-605). Since uint8_t can only hold values 0-255, an AS_PATH containing more than 63 ASNs (2 + 64*4 = 258 > 255) causes silent truncation. The truncated length is used for buffer sizing, while the actual data written is the full untruncated amount, resulting in a heap buffer overflow. Similarly, the path_segment_length field at line 621 is also uint8_t, truncating with more than 255 ASNs.
A heap buffer overflow vulnerability has been identified in FastNetMon Community Edition versions through 1.2.9. The issue arises from an integer overflow in the BGP AS_PATH attribute encoder, specifically in the 'IPv4UnicastAnnounce::get_attributes()' function. The vulnerability occurs because the attribute length is calculated based on the number of ASNs in the AS_PATH, and when this number exceeds a certain threshold, it leads to silent truncation. The truncated length is then used for buffer sizing, creating a mismatch that allows for a heap buffer overflow exploitation.
Users are advised to update to a version of FastNetMon Community Edition that addresses this vulnerability. As of now, no official patch has been released. In the meantime, the gRPC API can be bound to localhost to prevent external access, and BGP peers should be audited for AS_PATH length to avoid injecting long AS_PATHs into FastNetMon.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-122 | Heap-based Buffer Overflow | CISA-ADP |
| CWE-190 | Integer Overflow or Wraparound | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| pavel-odintsov fastnetmon | <= 1.2.9 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 26, 2026 | New CVE Received | [email protected] |