CVE-2026-86098 ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape
Attackers can trigger heap buffer overflow in ntop nDPI via crafted network packets, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-86098?
CVE-2026-86098 is a high-severity memory corruption vulnerability in ntop nDPI, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.
Weakness: CWE-787
Which versions are affected by CVE-2026-86098?
How do I fix CVE-2026-86098?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-86098 being exploited?
There is no known exploitation of CVE-2026-86098 in the wild and no public exploit code.
Sources
Also known as AZL-99945, DEBIAN-CVE-2026-86098, GHSA-c8vx-3h2j-4f8m, UBUNTU-CVE-2026-86098.