CVE-2026-122130
Description
A flaw was found in ipfixcol2. An integer overflow in the Forwarder output plugin allows an unauthenticated remote attacker to trigger a heap-based buffer overflow by sending oversized IP Flow Information Export (IPFIX) messages. A successful attack can cause the collector service to crash, leading to a Denial of Service (DoS), or result in memory corruption.
Statement
This vulnerability is rated as Important because an unauthenticated remote attacker can trigger a process crash or corrupt memory by transmitting malformed network flow packets. The issue specifically affects instances configured to relay flow telemetry using the forwarder output plugin over TCP. In standard Red Hat operational deployments, exposure is typically limited to internal monitoring networks receiving IPFIX or NetFlow data, but accessible collectors remain vulnerable to denial of service.
Mitigation
Restrict network access to the collector service so that only trusted flow exporters can transmit IPFIX traffic, or disable the forwarder output plugin if downstream relay functionality is not required.
1. Restrict ingress traffic on the IPFIX port (default TCP/UDP 4739) to authorized exporter subnets using firewalld:
firewall-cmd --permanent --zone=internal --add-source=192.168.1.0/24
firewall-cmd --permanent --zone=internal --add-port=4739/tcp
firewall-cmd --permanent --zone=internal --add-port=4739/udp
firewall-cmd --reload
2. Alternatively, remove or comment out the `<forwarder>` output plugin block within the ipfixcol2 configuration file (typically `/etc/ipfixcol2/startup.xml`), then restart the daemon:
systemctl restart ipfixcol2
Caveats:
Restricting network ingress requires maintaining an accurate list of legitimate exporter sources; traffic from unlisted hosts will be dropped. Disabling the forwarder output plugin terminates flow relaying to secondary collectors.
Warning: Reloading firewall rules or restarting the ipfixcol2 service will cause a temporary interruption in flow telemetry collection.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Memory; Execute Unauthorized Code or Commands
Write operations could cause memory corruption. In some cases, an adversary can modify control data such as return addresses in order to execute unexpected code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart
Attempting to access out-of-range, invalid, or unauthorized memory could cause the product to crash.
Other
Technical Impact: Unexpected State
Subsequent write operations can produce undefined or unexpected results.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
