Executive brief
ntop nDPI is an open-source deep packet inspection toolkit used to analyze and classify network traffic. A heap buffer overflow vulnerability in the ndpi_json_string_escape function allows attackers to corrupt memory by crafting malicious network packets containing TLS SNI, HTTP headers, or DNS names, potentially leading to denial of service or arbitrary code execution.
Technical details
The vulnerability is a heap buffer overflow in the ndpi_json_string_escape function that writes data beyond the bounds of a caller-supplied buffer. The function processes network protocol headers (TLS SNI, HTTP headers, DNS names) without proper length validation. An attacker can trigger the overflow by sending crafted network packets that reach the vulnerable function, resulting in heap memory corruption. No authentication or special privileges are required; the vulnerability is reachable via network traffic analysis. A patch is available in nDPI version 6.0 and later.
Affected products
- ntop nDPI before 6.0
Timeline
- 2026-09-04: disclosed