Memory Exhaustion in ipfixcol2 via LZ4 Header

Executive Summary

CVE-2026-122129 is a memory allocation vulnerability in CESNET ipfixcol2 versions 2.7.1 through 2.8.9. It exists in the Lz4Decoder::read_start_header() function where unauthenticated attackers can send TCP packets with abnormally large ring buffer sizes in LZ4 start headers. This forces the software to allocate up to 4 GiB of memory per connection, causing denial of service by exhausting system resources.

Useful 0 Not Useful 0

Detection Guidance

Monitor for excessive memory usage by ipfixcol2 processes, particularly when handling LZ4-encoded data. Check for unusually large TCP connections or high memory allocation requests. Use system monitoring tools like 'top', 'htop', or 'ps' to observe memory consumption spikes. Inspect network traffic for malformed LZ4 headers with abnormally large buffer sizes.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to crash or severely degrade the performance of ipfixcol2 by consuming all available memory. Systems running vulnerable versions may become unresponsive or crash entirely, leading to loss of data collection and monitoring capabilities. It requires no authentication and can be exploited remotely via network traffic.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with standards like GDPR and HIPAA by enabling denial-of-service attacks that disrupt the availability of IPFIX data collection. Memory exhaustion may cause service outages, potentially leading to unauthorized data access or loss of critical flow information required for auditing and monitoring.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ipfixcol2 to version 2.9.0 or later to apply the patch that limits buffer sizes. If upgrading is not immediately possible, restrict network access to the ipfixcol2 service using firewalls or network segmentation to reduce exposure. Monitor system resources closely for signs of memory exhaustion.

Useful 0 Not Useful 0