CVE-2026-86098: ntop nDPI Heap Buffer Overflow Vulnerability

CVE-2026-86098 Overview

CVE-2026-86098 is a heap buffer overflow vulnerability in ntop nDPI versions before 6.0. The flaw resides in the ndpi_json_string_escape function, which writes beyond caller-supplied buffer boundaries when escaping strings for JSON serialization. Attackers can trigger the overflow by supplying crafted network packet data, including Transport Layer Security (TLS) Server Name Indication (SNI) values, HTTP headers, or Domain Name System (DNS) names that reach the vulnerable function. Successful exploitation results in heap corruption within any application or sensor consuming nDPI for deep packet inspection. The issue is classified under [CWE-787] Out-of-Bounds Write.

Critical Impact
Remote attackers can corrupt heap memory in network monitoring sensors by sending crafted packets, potentially leading to process crashes or arbitrary code execution within the parsing context.

Affected Products

ntop nDPI versions prior to 6.0
Applications and sensors linking the nDPI deep packet inspection library
Network monitoring and traffic classification tools built on nDPI serializer components

Discovery Timeline

2026-09-04 - CVE-2026-86098 published to the National Vulnerability Database (NVD)
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-86098

Vulnerability Analysis

The vulnerability exists in ndpi_json_string_escape, a helper used by the nDPI serializer to produce JSON-safe representations of strings extracted from network traffic. The function writes escaped output into a buffer provided by the caller without validating that the escaped length fits within the destination. When input contains characters requiring multi-byte escape sequences, the produced output can exceed the buffer size and overwrite adjacent heap memory.

Because nDPI is commonly deployed as a passive traffic classifier, the vulnerable code path is reachable from arbitrary network input. Fields extracted from TLS handshakes, HTTP request and response headers, and DNS queries flow directly into serialization routines. See the VulnCheck Advisory on nDPI for additional context on the affected code path.

Root Cause

The root cause is missing bounds validation in the string-escape logic within nDPI serializer source code. The function calculates escape output without reconciling it against the caller-supplied buffer length, producing a classic out-of-bounds write on the heap. The upstream fix landed in nDPI commit 94e82c1.

Attack Vector

An unauthenticated remote attacker triggers the flaw by injecting crafted values into protocol fields that nDPI parses and serializes. Practical vectors include a TLS ClientHello with a malformed SNI, an HTTP request with oversized or escape-heavy header values, and DNS queries containing crafted labels. No authentication or user interaction is required, though exploitation depends on the sensor invoking the JSON serializer on the attacker-controlled string.

No verified public exploit code is available. Refer to the nDPI project repository for source-level details of the affected component.

Detection Methods for CVE-2026-86098

Indicators of Compromise

Unexpected crashes, segmentation faults, or heap corruption warnings in processes linking nDPI (for example, ntopng or custom sensors)
AddressSanitizer or glibc heap corruption messages referencing ndpi_json_string_escape in application logs
Repeated malformed TLS ClientHello, HTTP header, or DNS query patterns targeting monitored network segments

Detection Strategies

Enumerate hosts running nDPI-based tooling and confirm the linked library version against the 6.0 release boundary
Enable heap hardening or sanitizer builds in test environments to surface out-of-bounds writes originating from the serializer
Correlate sensor process restarts with inbound traffic anomalies containing unusually long or heavily escaped protocol strings

Monitoring Recommendations

Alert on abnormal termination of nDPI-consuming processes, particularly when accompanied by malloc or free error messages
Monitor perimeter traffic for TLS SNI, HTTP header, and DNS name fields exceeding typical length thresholds
Forward sensor host telemetry to a centralized data lake to correlate crashes with concurrent network events

How to Mitigate CVE-2026-86098

Immediate Actions Required

Upgrade nDPI to version 6.0 or later on every host where the library is deployed
Rebuild and redistribute downstream applications, including ntopng and custom sensors, against the patched library
Restrict which network segments feed untrusted traffic into nDPI-based classifiers until patched versions are in place

Patch Information

The fix is committed to the upstream nDPI repository in commit 94e82c1 and shipped in the 6.0 release. Operators should pull the tagged release from the ntop nDPI project repository and validate that dependent binaries link against the updated shared object.

Workarounds

Disable JSON serialization output paths in nDPI consumers where configurable, avoiding calls into the vulnerable escape routine
Deploy upstream filtering to drop packets with malformed or excessively long TLS SNI, HTTP header, and DNS name fields
Isolate sensors behind ingress controls so untrusted traffic cannot directly reach the deep packet inspection pipeline

bash

# Verify installed nDPI version and rebuild against the patched release
ndpiReader -v 2>&1 | head -n 1
git clone https://github.com/ntop/nDPI.git && cd nDPI
git checkout 6.0
./autogen.sh && ./configure && make && sudo make install