CVE-2026-38968
CVE-2026-38968
This page contains facts from public vulnerability sources. Check the original advisory before updating.
ntopng through 6.6 is vulnerable to Predictable Session Identifier which can lead to Session Hijacking. HTTP session identifiers in src/HTTPserver.cpp use weak time-seeded pseudo-randomness during session creation. As a result, fresh authenticated logins can receive deterministic or colliding session cookies under attacker-controlled timing.
CVSS 9.8 · Critical · EPSS 0.6%
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
ntopng Ubuntu:Pro:16.04:LTS
- Versions
- 1.2.1+dfsg1-2ubuntu1
- 2.0+dfsg1-1
- 2.2+dfsg1-1
- 2.2+dfsg1-1build1
- 2.2+dfsg1-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ntopng Ubuntu:Pro:18.04:LTS
- Versions
- 2.4+dfsg1-3
- 2.4+dfsg1-4
- 3.2+dfsg1-1
- 3.2+dfsg1-1ubuntu0.1~esm2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ntopng Ubuntu:20.04:LTS
- Versions
- 3.8+dfsg1-2.1build3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ntopng Ubuntu:22.04:LTS
- Versions
- 5.2.1+dfsg1-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ntopng Ubuntu:24.04:LTS
- Versions
- 5.2.1+dfsg1-1
- 5.2.1+dfsg1-1ubuntu1
- 5.2.1+dfsg1-1ubuntu3
- 5.2.1+dfsg1-1ubuntu4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ntopng Ubuntu:25.10
- Versions
- 5.2.1+dfsg1-2ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published