---
id: CVE-2026-92694
title: >-
  FastNetMon: IPv6 host counters map iterated without lock, racing concurrent
  inserts
summary: >-
  FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9
  and earlier, FastNetMon's IPv6 top-talkers screen-draw thread in
  draw_table_ipv6() in src/fastnetmon_logic.cpp iterates
  ipv6_host_counters.average_speed_map with…
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-362
vendor: pavel-odintsov
product: fastnetmon
affected:
  - fastnetmon <= 1.2.9
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T22:29:26.943Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-92694'
references:
  - url: >-
      https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-phrw-2q76-5m7h
    label: >-
      https://github.com/pavel-odintsov/fastnetmon/security/advisories/GHSA-phrw-2q76-5m7h
  - url: 'https://github.com/pavel-odintsov/fastnetmon/pull/1087'
    label: 'https://github.com/pavel-odintsov/fastnetmon/pull/1087'
  - url: >-
      https://github.com/pavel-odintsov/fastnetmon/commit/1294724ea931dc78fe545360f2193398bba35381
    label: >-
      https://github.com/pavel-odintsov/fastnetmon/commit/1294724ea931dc78fe545360f2193398bba35381
tags:
  - cve.org
ingestedAt: '2026-11-05T23:41:31.944Z'
epss: 0.00247
epssPercentile: 0.16032
---

## Overview

FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, FastNetMon's IPv6 top-talkers screen-draw thread in draw_table_ipv6() in src/fastnetmon_logic.cpp iterates ipv6_host_counters.average_speed_map without holding counter_map_mutex while recalculate_speed() inserts new keys and may rehash the same map. The race requires networks_list to include the targeted IPv6 range. It causes confirmed undefined behavior under load; a process crash is plausible but was not observed, so reliable denial of service has not been established. No fixed release is available as of this review.

## Affected

- `fastnetmon <= 1.2.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.