CVE-2026-48691 is a critical integer overflow (CVSS 9.8) in the BGP AS_PATH encoder of FastNetMon Community Edition through 1.2.9. A length stored in one byte wraps, so the buffer is too small for the data. The researcher reports the vendor shipped a fix in FastNetMon 2.0.380.
What's affected
FastNetMon Community Edition through 1.2.9, function IPv4UnicastAnnounce::get_attributes() in src/bgp_protocol.hpp. The researcher reports the vendor fixed it in 2.0.380.
The record says an AS_PATH of more than 63 AS numbers triggers the wrap. The researcher rates it 7.5 and notes it is an encoder bug, reached when FastNetMon builds BGP messages, for example through the gRPC API.
How to check if you're exposed
List FastNetMon installs and read the version. Community Edition through 1.2.9 is the stated range.
dpkg -l | grep -i fastnetmon
rpm -qa | grep -i fastnetmon
Also list who can send BGP, NetFlow, sFlow or IPFIX traffic to the collector.
Also check who can call the FastNetMon gRPC API, since it can drive the encoder.
What to do now
- Find FastNetMon installs and versions.
- Upgrade to 2.0.380 or later.
- Restrict the gRPC API and BGP peers to trusted systems.
- Watch for crashes when long AS paths are announced.
Why it matters
The classes are CWE-190, integer overflow, and CWE-122, heap based buffer overflow. The length is computed as a small header plus four bytes per AS number and held in an 8 bit field. Past 255 the value wraps, the buffer is sized from the wrapped number, and the code then writes the full amount, overflowing the heap.
BGP allows a two byte length for attributes of this size, which the encoder does not use. The lesson is to pick a field wide enough for the largest value the protocol allows. The record does not mark this CVE as exploited, and it is not on the CISA Known Exploited Vulnerabilities list.
There is no package manifest to scan for this one, so inventory comes first. List every host, instance or device running an affected build. The Gold directory page for CVE-2026-48691 is a handy place to follow later updates.
Quick check
Is this a parser bug?
No. The researcher notes this one is in the encoder that builds outgoing BGP messages.
Sources
Last reviewed: 19 October 2026.
