CVE-2026-122130
Received Received - Intake

Integer Overflow in ipfixcol2 Forwarder Output Plugin

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-05
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-122130
EUVD
EUVD-2026-117084

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
CESNET ipfixcol2 2.3.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow in CESNET ipfixcol2 versions 2.3.0 through 2.8.0 affecting the Forwarder output plugin. It allows unauthenticated IPFIX exporters to send near-65535-byte data sets or large templates to a TCP-based collector, causing a heap buffer overflow. This can crash the collector and enable 2-byte writes to attacker-controlled memory addresses.

Detection Guidance

To detect this vulnerability, check the version of ipfixcol2 running on your system. If it is version 2.3.0 through 2.8.0, it is vulnerable. Use commands like 'ipfixcol2 --version' or check package managers (e.g., 'dpkg -l ipfixcol2' or 'rpm -qa | grep ipfixcol2'). Monitor network traffic for unusually large IPFIX messages approaching 65535 bytes or malformed templates sent to TCP collectors.

Impact Analysis

The impact includes denial of service via collector crashes and potential arbitrary code execution due to heap buffer overflow. Attackers could exploit this to disrupt IPFIX data collection or manipulate memory, though the 2-byte write limitation may constrain the severity of exploitation.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks or arbitrary code execution on systems processing sensitive data. GDPR requires protecting personal data integrity and availability, while HIPAA mandates safeguarding protected health information. A successful exploit could disrupt data collection or expose sensitive information, violating these standards.

Mitigation Strategies

Upgrade ipfixcol2 to version 2.9.0 or later immediately. If upgrading is not possible, disable the Forwarder output plugin or restrict network access to the IPFIX collector to trusted sources only. Apply network-level mitigations such as rate limiting or deep packet inspection to block oversized messages.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122130. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...