Read the docs
TI-2026-58899 Aliases CVE-2026-86098GHSA-c8vx-3h2j-4f8m

ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape

Priority LOW 37CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00592 48th percentileScored 2026-11-07
Fix Fixed nDPI (ntop): 6.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ntopnDPIbefore 6.06.0Patch availableCNA
  • nDPI Vendorntop Affected before 6.0 Fixed in 6.0 Patch available CNA

Remediation

  • Fix · CNA nDPI (ntop) Fixed in 6.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-86098
  2. 2026-10-03 Alias added: GHSA-c8vx-3h2j-4f8m

References

Patch 1

Other 2

  • TI-2026-58397 ntopng: Missing Authorization on System Configuration Backup Download and Listing CVSS 3.1HIGH 8.8
  • TI-2026-58894 ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler CVSS 4.0HIGH 7.1
  • TI-2026-58396 ntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags CVSS 3.1HIGH 7.1
  • TI-2026-85500 Stack buffer overflow in ntopng nDPI custom category detection CVSS 3.1MEDIUM 5.3
  • TI-2026-28235 ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to… CVSS 3.1CRITICAL 9.8
  • TI-2020-09603 In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer… CVSS 3.1CRITICAL 9.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences