# CVE-2026-97371: ntopng stack buffer overflow in nDPI custom category detection

Source: https://junglewise.ai/threats/cve-2026-97371-ntopng-is-a-web-based-network-traffic-monitoring-application  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-97371 · Severity: medium · CVSS 5.3 · Published 2026-11-05

ntopng is a web-based network traffic monitoring application used to analyze and monitor network activity. A remote attacker on the same network can send specially crafted packets that trigger a stack buffer overflow during packet inspection, causing the application to crash or potentially allowing code execution. No authentication or special access is required—any packet matching custom category rules can trigger the vulnerability.

Technologies: [Ntopng](https://junglewise.ai/threats/technologies/ntopng). Vendors: [Ntop](https://junglewise.ai/threats/vendors/ntop).

## Quick answers

**Is CVE-2026-97371 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97371 being exploited in the wild.

**How severe is CVE-2026-97371?** Medium severity, with a CVSS score of 5.3, published 5 November 2026.

**Which products and versions are affected?** Ntopng prior to 6.7.260721.

**Is there a fix for CVE-2026-97371?** Yes: fixed in 6.7.260721. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97371 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-97371?** Check whether you run Ntopng at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 6.7.260721

## Technical details

The ndpi_get_custom_category_match function performs a 4-byte write to a 2-byte stack variable (id) in IpAddress::reloadBlacklist during packet dissection and host initialization, causing stack corruption. The vulnerability is network-triggered with no authentication required and occurs in the normal packet processing path. A remote attacker on the monitored network segment can send crafted packets to trigger stack overflow, leading to denial of service or potential code execution.

## Affected products

- ntop ntopng prior to 6.7.260721

## Timeline

- 2026-07-21: disclosed
- 2026-07-21: patched

## References

- [https://github.com/ntop/ntopng/commit/96acb6187950a6a49ca827e49973c3e0c27ea664](https://github.com/ntop/ntopng/commit/96acb6187950a6a49ca827e49973c3e0c27ea664)
- [https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7](https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7)

## Related threats

- [ntopng OS command injection in vulnerability-scan REST endpoint](https://junglewise.ai/threats/cve-2026-82413-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng authorization bypass in system configuration backup download](https://junglewise.ai/threats/cve-2026-84990-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng missing authorization check in blacklist editor](https://junglewise.ai/threats/cve-2026-83621-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng remote code execution via unauthenticated scan endpoints](https://junglewise.ai/threats/cve-2026-82412-ntopng-is-a-web-based-network-traffic-monitoring-application)
- [ntopng privilege escalation in pools bulk-delete endpoint](https://junglewise.ai/threats/cve-2026-86091-ntopng-privilege-escalation-in-pools-bulk-delete-endpoint)