CVE-2026-122127
Description
A flaw was found in ipfixcol2. A heap-based buffer overflow in the LZ4 decompression component allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by crashing the collector service. By sending network traffic that specifies a small buffer size alongside a disproportionately large decompressed data size, the attacker can trigger an out-of-bounds memory write.
Statement
This vulnerability is rated as an Important severity flaw because an unauthenticated remote adversary can crash the flow collector without requiring privileges, leading to a complete disruption of network telemetry ingestion. The flaw is confined to deployments utilizing the TCP input plugin configured with LZ4 decompression for IPFIX records. While the crash terminates the service, the impact remains limited to availability without compromising system confidentiality or data integrity.
Mitigation
Restrict network access to the collector service to trusted IPFIX exporters using firewall rules, or disable the service if network telemetry collection is not required:
1. Restrict access using firewalld to permit only trusted flow exporters:
firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_EXPORTER_IP>
firewall-cmd --reload
2. Alternatively, stop and disable the ipfixcol2 service:
systemctl stop ipfixcol2
systemctl disable ipfixcol2
Caveats:
Restricting access will prevent unlisted or unauthorized exporters from delivering IPFIX packets. Stopping the service halts all flow monitoring on the target host.
Warning: Reloading firewall rules takes effect immediately on network traffic. Stopping the ipfixcol2 service terminates active network telemetry sessions and causes service downtime.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
