p PatchFirst

CVE-2026-86098

CVE-2026-86098 · ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape

This page contains facts from public vulnerability sources. Check the original advisory before updating.

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.

CVSS 8.3 · High · EPSS 0.6% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • ndpi

    Versions
    • ≥ 0, < 6.0: Affected (custom)
    • 6.0: Not affected (custom)

    Update to 6.0

  • ndpi Debian:12

    Versions
    • 4.2-2
    • 4.2-2.1
    • 4.2-2.1~exp1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ndpi Debian:13

    Versions
    • 4.2-2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ndpi Debian:14

    Versions
    • 4.2-2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ndpi Ubuntu:16.04:LTS

    Versions
    • 1.5.0-1
    • 1.6-1
    • 1.7.1~git20151130.6f3d5a7-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ndpi Ubuntu:18.04:LTS

    Versions
    • 1.8-1
    • 2.2-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ndpi Ubuntu:20.04:LTS

    Versions
    • 2.6-4
    • 2.6-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ndpi Ubuntu:22.04:LTS

    Versions
    • 4.0-4
    • 4.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ndpi Ubuntu:24.04:LTS

    Versions
    • 4.2-2
    • 4.2-2.1
    • 4.2-2.1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ndpi Ubuntu:26.10

    Versions
    • 4.2-2.1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • ndpi Ubuntu:26.04:LTS

    Versions
    • 4.2-2.1build1
    • 4.2-2.1build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →