What’s Vulnerable › Vulnerabilities

CVE-2026-86098: ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-09-23
• Weakness: CWE-787

Description

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.

Affected products

• ntop nDPI: before 6.0 — fixed in 6.0

How to fix

Upgrade to a fixed version: ntop nDPI 6.0. Check the vendor advisory for mitigations.

References

• https://github.com/ntop/nDPI
• https://github.com/ntop/nDPI/blob/5.0/src/lib/ndpi_serializer.c
• https://github.com/ntop/nDPI/commit/94e82c1de12323d992895830231865736a8abf2c
• https://www.vulncheck.com/advisories/ntop-ndpi-before-6.0-heap-buffer-overflow-via-ndpi-json-string-escape

Get alerted when CVE-2026-86098 or the next vulnerability affects your stack