HIGH 8.3 NVD
CVE-2026-86098
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer bou
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.
References
- https://github.com/ntop/nDPI
- https://github.com/ntop/nDPI/blob/5.0/src/lib/ndpi_serializer.c
- https://github.com/ntop/nDPI/commit/94e82c1de12323d992895830231865736a8abf2c
- https://www.vulncheck.com/advisories/ntop-ndpi-before-6.0-heap-buffer-overflow-via-ndpi-js
This high severity vulnerability with a CVSS score of 8.3 was published on 2026-09-04 via NVD.
vulnfeed aggregates 10149 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.