CVE-2026-86098

Name of the Vulnerable Software and Affected Versions ntop nDPI versions prior to 6.0

Description An out-of-bounds heap write exists in the ndpi json string escape() function. This occurs because the function lacks an enforceable maximum length for the destination buffer when escaping characters for JSON serialization. A single input byte can expand into up to six output characters (e.g., u00xx), and if the calling application allocates insufficient space, the function writes beyond the heap buffer boundaries. An unauthenticated attacker can trigger this by supplying crafted network metadata, such as TLS Server Name Indication (SNI) values, HTTP headers, or DNS names. This can lead to heap corruption, resulting in process crashes, disruption of monitoring telemetry, or potential conditional remote code execution.

Recommendations Upgrade to nDPI version 6.0 or apply a vendor-confirmed patched backport for versions prior to 6.0. Rebuild and redeploy any applications that use nDPI as a statically linked library to ensure the fix is incorporated into the binary.