CVE-2026-122129

Medium

Description

CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service.

SeverityMedium

CVSS5.3

Exploit probability—

ProductCesnet Ipfixcol2

PublishedNov 4, 2026

First seenNov 4, 2026

Weakness typeCWE-789CWE-789

How to fix

Update

CESNET ipfixcol22.9.0 or later

Patches

github.com/CESNET/ipfixcol2/commit/1a199033eff847941353c5c039cb806a9ad8aa6f

Vendor advisories

github.com/CESNET/ipfixcol2/releases/tag/v2.9.0

Affected products

Product	Affected versions	Fixed in
CESNET ipfixcol2	2.7.1 ≤ v < 2.9.0	2.9.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.