Michal Sedlak

A heap-based buffer overflow exists in Lz4Decoder.cpp, allowing unauthenticated network peers to write past heap buffers. This occurs when an attacker specifies a small `ring buffer size` followed by a large `decompressed size`, enabling the writing of up to 65535 controlled bytes, which can lead to a collector crash.

An issue exists in the `Lz4Decoder::read start header()` function where unauthenticated attackers can cause memory exhaustion. By opening TCP connections and sending LZ4 start headers with unbounded ring buffer sizes, an attacker can force allocations of up to 4 GiB per connection, resulting in a denial of service for the collector.

An integer overflow exists in the Forwarder output plugin. Unauthenticated IPFIX exporters can trigger a heap buffer overflow by wrapping `uint16 t` message length counters. This occurs when attackers send large templates and data sets near 65,535 bytes to a collector forwarding over TCP, potentially leading to a system crash or allowing 2-byte writes to addresses influenced by the attacker.