Heap Buffer Overflow in ntop nDPI

ntop nDPI versions prior to 6.0 contain a critical heap-based buffer overflow vulnerability located in the ndpi_json_string_escape function. This function is responsible for escaping strings during JSON serialization of captured network metadata. The vulnerability occurs when the function processes overly long or specially formatted input strings, leading to an out-of-bounds write beyond caller-supplied buffer boundaries. An attacker can trigger this vulnerability by providing malicious network traffic containing crafted TLS SNI fields, HTTP headers, or DNS names that are subsequently parsed and processed by nDPI. Successful exploitation of this vulnerability leads to heap memory corruption, which may result in application crashes or, potentially, arbitrary code execution within the context of the process running the nDPI library. Given that nDPI is widely used in network traffic analysis and security monitoring tools, this vulnerability presents a significant risk to the integrity and stability of security infrastructure.

Impact

Successful exploitation of CVE-2026-86098 could result in denial-of-service conditions due to application crashes or unauthorized code execution. Because nDPI is integrated into many network monitoring, IDS, and traffic analysis solutions, victims include organizations utilizing these tools for deep packet inspection. The corruption of heap memory can lead to unstable system states, potentially allowing an attacker to bypass security controls or gain persistent access to the network analysis environment.

Recommendation

• Upgrade ntop nDPI to version 6.0 or later immediately to address the vulnerability documented in CVE-2026-86098.
• Audit network monitoring devices or security applications that incorporate the nDPI library for potential exposure.
• Restrict access to network analysis interfaces and ensure that traffic processing nodes are segmented from critical internal systems.