CVE-2026-86098: ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpijsonstringescape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ntop nDPIto a version that resolves this vulnerability.Fixed in 6.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using ntop nDPI versions earlier than 6.0 are affected. The vulnerable code can be reached when nDPI processes network packet data containing TLS SNI values, HTTP headers, or DNS names.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the supplied severity vector. Exploitation requires crafted packet data that reaches ndpi_json_string_escape, and the attack complexity is rated high.
What is the impact if exploitation succeeds?
Successful exploitation causes heap corruption through a write beyond a caller-supplied buffer boundary. The reported impact includes high integrity and availability effects, with no confidentiality impact listed.
What should be done to remediate the issue?
Upgrade nDPI to version 6.0 or later, since versions before 6.0 are identified as vulnerable. The referenced commit 94e82c1de12323d992895830231865736a8abf2c is associated with the issue.