CVE-2026-122129

MediumCVSS 5.3/10Last modified Nov 5, 2026

Description

CESNET ipfixcol2 2.7.1 before 2.9.0 contains a memory allocation vulnerability in Lz4Decoder::read_start_header() that allows unauthenticated attackers to exhaust memory by declaring unbounded ring buffer sizes. Attackers can open TCP connections sending LZ4 start headers with very large buffer sizes, forcing up to 4 GiB allocations per connection and denying collector service.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-789

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 4, 2026
Last modified: Nov 5, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-122134.3A vulnerability was found in hcengineering Huly Platform up to 0.7.0. Affected by this vulnerability is the function getAccountInfo of the f CVE-2026-1221308.2CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IP CVE-2026-1221313.7Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() th CVE-2026-1221326.1go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect v CVE-2026-1221338.8Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.e CVE-2026-1221348.8Mistral Vibe before 2.25.7 contains a remote code execution vulnerability that allows attackers to run commands by configuring malicious Git CVE-2026-1221358.8Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by abusing repository-configu CVE-2026-1221364.4Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite CVE-2026-1221376.7Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses atta CVE-2026-1221385.3BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-CVE-2026-1221395.3blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unaut CVE-2026-122147.8A security flaw has been discovered in Qihoo 360 Total Security 6.0. This vulnerability affects the function RpcStringBindingComposeW of the