SB2026081569 - Multiple vulnerabilities in nfdump

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081569

SB2026081569 - Multiple vulnerabilities in nfdump

Published: August 15, 2026

Security Bulletin ID SB2026081569
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 20
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 95% Low 5%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 20 vulnerabilities.


1) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a null pointer dereference in GetSubTemplateSequencer() when processing a crafted NetFlow v9 packet containing IPFIX-specific sub-template field types. A remote attacker can send a specially crafted UDP packet to cause a denial of service.

A single packet can crash nfcapd, and repeated packets can cause repeated collector crashes.


2) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the nfcapd IPFIX template sequencer ring when processing crafted IPFIX options template replacement datagrams. A remote attacker can send specially crafted UDP/IPFIX datagrams to cause a denial of service.

No user interaction is required.


3) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in the readExtendedGateway_v2() parser in src/sflow/sflow_process.c when parsing a crafted sFlow v2 extended gateway UDP packet. A remote attacker can send a single crafted UDP packet to cause a denial of service.

The issue occurs because a wire-controlled dst_as_path_len value is multiplied by 4 without overflow checking, leading to out-of-bounds array indexing and a crash. The sFlow protocol has no authentication.


4) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in decodeIPLayer4() in src/sflow/sflow_process.c when processing sFlow flow samples containing truncated TCP headers. A remote attacker can send a specially crafted sFlow flow sample to disclose sensitive information.

This issue occurs when the captured packet header is truncated near the start of the TCP header, such as with short snapshot lengths.


5) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the MPLS label stack parser in decodeLinkLayer() when parsing crafted sFlow data. A remote attacker can send specially crafted sFlow input to cause a denial of service.

After VLAN tag peeling, the parser may reach MPLS processing with insufficient remaining bytes, and a dereference past the end of the buffer may trigger a SIGSEGV when determining the inner protocol type.


6) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause corrupted flow records.

The vulnerability exists due to integer overflow in the sFlow extended gateway communities parser when parsing a crafted sFlow packet. A remote attacker can supply a crafted communities length value to misalign subsequent parsing and cause corrupted flow records.

In DEVEL builds, the issue can also trigger an out-of-bounds read that may crash the process.


7) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to out-of-bounds read in the sFlow 802.11 MAC parser when processing wireless bridge frames. A remote attacker can send a specially crafted sFlow record to disclose sensitive information.

Only 802.11 data frames with both ToDS and FromDS flags set trigger the read past the header boundary, and 6 bytes are copied into flow records where they remain visible to readers of the stored flow data.


8) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to corrupt parser state.

The vulnerability exists due to integer overflow in mplsLabelStack() and readExtendedVlanTunnel() in src/sflow/sflow_process.c when processing a crafted sFlow v5 extended data tag with an oversized depth field. A remote attacker can send a single crafted UDP packet to corrupt parser state.

The issue is reachable through the SFLFLOW_EX_MPLS and SFLFLOW_EX_VLAN_TUNNEL extended data tags.


9) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in the sFlow parser getData32_nobswap() read function when parsing sFlow datagrams. A remote attacker can send a specially crafted sFlow packet that reaches the end of the buffer to cause a denial of service.

The issue occurs because the buffer pointer is dereferenced before bounds are checked, and a crash may occur if the read crosses a page boundary into unmapped memory.


10) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow or wraparound in PushArrayNextElement and the NBAR/ifvrf option data processing path when processing a crafted IPFIX or NetFlow v9 option template followed by an oversized data flowset. A remote attacker can send crafted UDP datagrams to corrupt the array record header and cause a denial of service.

Exploitation is reachable with two unauthenticated UDP packets to the nfcapd collector: one to install the option template and one to supply the oversized data flowset.


11) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in AddNbarRecord() and InsertNbarAppInfo() in src/nfdump/nbar.c when parsing a crafted nfcapd file with nfdump -r. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open the crafted file.


12) Integer overflow (CVE-ID: N/A)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to integer overflow in Process_v9_option_templates() in src/netflow/netflow_v9.c when processing NetFlow v9 option templates. A remote attacker can send a specially crafted UDP packet to cause a denial of service.

The issue can also cause heap data to be read beyond the allocation boundary and written into nbar or ifvrf flow records stored on disk.


13) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in ReadAppendix() in src/libnffile/nffile.c when parsing a crafted nfcapd file. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open a crafted file with nfdump -r.


14) NULL pointer dereference (CVE-ID: N/A)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to null pointer dereference in ConvertRecordV2() in src/nfdump/compat_1_6_x/convert.c when processing a legacy v1.6.x block in which a CommonRecordType record appears before any ExtensionMapType record. A local user can supply a specially crafted file to cause a denial of service.

The issue affects the legacy v1.6.x block conversion path.


15) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in AddIfNameRecord() and AddVrfNameRecord() in src/nfdump/ifvrf.c when parsing a crafted nfcapd file with a malformed interface or VRF name array record via nfdump -r. A remote attacker can trick the victim into opening a specially crafted file to cause a denial of service.

User interaction is required to open the crafted file.


16) Out-of-bounds read (CVE-ID: N/A)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in Convert_v1fileHeader() when parsing a crafted legacy v1-layout capture file with nfdump -r. A remote attacker can trick the victim into opening a crafted file to cause a denial of service.

User interaction is required to open the crafted file with nfdump -r.


17) Division by zero (CVE-ID: N/A)

CWE-ID: CWE-369 - Divide By Zero

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to divide by zero in the nfcapd IPFIX options template handlers when processing crafted IPFIX options templates and subsequent data sets. A remote attacker can send two specially crafted UDP datagrams to cause a denial of service.

The issue is triggered when cumulative attacker-controlled field lengths wrap a 16-bit record offset to zero before division, and the same root cause is reachable through both the NBAR option-data handler and the interface-name option-data handler.


18) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to loop with unreachable exit condition in ProcessSubTemplate() in src/libnffile/nfxV3.c when processing IPFIX subTemplateMultiList data with a zero-size subTemplateSize entry. A remote attacker can send two specially crafted UDP datagrams to cause a denial of service.

The issue causes CPU exhaustion without memory corruption, a crash, or disk exhaustion.


19) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to loop with unreachable exit condition in Process_ipfix_data() when processing IPFIX data records that reference a template containing a zero-length fixed-length field. A remote attacker can send a crafted IPFIX template followed by a data record to cause a denial of service.

A single follow-up data datagram can sustain the condition indefinitely without further network traffic, leading to CPU exhaustion and unbounded output-file growth.


20) Use-after-free (CVE-ID: N/A)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to use-after-free in the nfcapd IPFIX template withdrawal handling when processing a valid withdraw-all IPFIX message after a template has been installed for the same exporter and observation domain. A remote attacker can send specially crafted UDP/IPFIX datagrams to cause a denial of service.

The issue is triggered by two unauthenticated datagrams from an accepted exporter: one to install a data template and one withdraw-all message for the same source IP and observation domain.


Remediation

Install update from vendor's website.

References