CVE-2026-48691

Name	CVE-2026-48691
Description	FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4UnicastAnnounce::get_attributes() function computes attribute_length as 'sizeof(bgp_as_path_segment_element_t) + this->as_path_asns.size() * sizeof(uint32_t)' and stores it in a uint8_t field (line 600-605). Since uint8_t can only hold values 0-255, an AS_PATH containing more than 63 ASNs (2 + 64*4 = 258 > 255) causes silent truncation. The truncated length is used for buffer sizing, while the actual data written is the full untruncated amount, resulting in a heap buffer overflow. Similarly, the path_segment_length field at line 621 is also uint8_t, truncating with more than 255 ASNs.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1138646

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fastnetmon (PTS)	bookworm, bookworm (security)	1.2.4-2+deb12u1	vulnerable
	trixie	1.2.8-1	vulnerable
	forky, sid	1.2.9-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
fastnetmon	source	(unstable)	1.2.9-1	unimportant		1138646

Notes

https://lorikeetsecurity.com/blog/fastnetmon-cve-2026-48691-bgp-as-path-overflow
Not a vulnerability, at best an interop issue
https://github.com/pavel-odintsov/fastnetmon/commit/94c66d5b100c42fb8bd10a22ca595e46895d60d0 (v1.2.9)
https://github.com/pavel-odintsov/fastnetmon/pull/1054