CVE-2026-86098

high

Description

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.

References

https://www.vulncheck.com/advisories/ntop-ndpi-before-6.0-heap-buffer-overflow-via-ndpi-json-string-escape

https://github.com/ntop/nDPI/commit/94e82c1de12323d992895830231865736a8abf2c

https://github.com/ntop/nDPI/blob/5.0/src/lib/ndpi_serializer.c

https://github.com/ntop/nDPI

Details

Source: Mitre, NVD

Published: 2026-09-04

Updated: 2026-09-04

Risk Information

CVSS v2

Base Score: 7.1

Vector: CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:C

Severity: High

CVSS v3

Base Score: 7.4

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Severity: High

CVSS v4

Base Score: 8.3

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Severity: High

EPSS

EPSS: 0.00353