Vulnerability · Published Sep 4, 2026 · Assigned by VulnCheck
CVE-2026-86098ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape
High 7.4
In plain English
A high-severity out-of-bounds write in nDPI from ntop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.6%top 51.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ndpi | no fix listed | DEBIAN-CVE-2026-86098 |
| Debian:13 | ndpi | no fix listed | DEBIAN-CVE-2026-86098 |
| Debian:14 | ndpi | no fix listed | DEBIAN-CVE-2026-86098 |
| Ubuntu:22.04:LTS | ndpi | no fix listed | UBUNTU-CVE-2026-86098 |
| Ubuntu:24.04:LTS | ndpi | no fix listed | UBUNTU-CVE-2026-86098 |
| Ubuntu:26.04:LTS | ndpi | no fix listed | UBUNTU-CVE-2026-86098 |
| Ubuntu:26.10 | ndpi | no fix listed | UBUNTU-CVE-2026-86098 |
Affected products (as reported)
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
References
- Patch Commit patch
- https://github.com/ntop/nDPI product
- ndpi_json_string_escape() unbounded writes at release 5.0 technical-description
- VulnCheck Advisory: ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape third-party-advisory