TI-2020-09603 Aliases CVE-2020-11939 GHSA-x59q-66q3-mmf8

In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer…

MEDIUM 48CWE-190Published 2020-04-23 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-190 and the CVSS impact.

Summary

In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Due to the granular nature of the overflow primitive and the ability to control both the contents and layout of the nDPI library's heap memory through remote input, this vulnerability may be abused to achieve full Remote Code Execution against any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis.

Why it matters now

EPSS 0.03302 88th percentileScored 2026-11-08

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:ntop:ndpi::::::::	up to 3.2	Vulnerable	ntop

cpe:2.3:a:ntop:ndpi:*:*:*:*:*:*:*:* Versions up to 3.2 Vulnerable ·ntop

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-11939
2026-10-03 Alias added: GHSA-x59q-66q3-mmf8

References

Exploit 1

https://securitylab.github.com/advisories/GHSL-2020-051_052-ntop-ndpi

Patch 1

https://github.com/ntop/nDPI/commit/7ce478a58b4dd29a8d1e6f4e9df2f778613d9202

TI-2020-12182 In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain… CVSS 3.1CRITICAL 9.8
TI-2020-12181 In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c. CVSS 3.1CRITICAL 9.8
TI-2021-14532 ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello. CVSS 3.1HIGH 8.8
TI-2020-12180 In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read… CVSS 3.1CRITICAL 9.1
TI-2020-12179 In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read… CVSS 3.1CRITICAL 9.1
TI-2020-12178 In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer… CVSS 3.1CRITICAL 9.1

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences