CVE-2026-86098

ntop's nDPI deep-packet-inspection library before version 6.0 contains a heap buffer overflow (CWE-787) in its ndpi_json_string_escape function, which writes beyond the boundaries of a caller-supplied buffer while escaping dissected metadata into JSON. A remote, unauthenticated attacker can trigger it by sending crafted network traffic whose inspected fields - TLS SNI, HTTP headers, or DNS names - produce strings long enough to overflow during JSON serialization of flow metadata. Successful exploitation causes heap corruption in the analyzing process, which per the CVSS 4.0 vector yields high integrity and availability impact (memory corruption or crashes) with no confidentiality impact, and the high attack complexity plus required attack conditions (AC:H/AT:P) make reliable exploitation harder. Anyone running a product that embeds nDPI before 6.0 and dissects untrusted traffic is affected, most notably the ntop monitoring stack (ntopng, nProbe) and other third-party tools built on the library. The flaw is not yet known to be exploited: it is absent from CISA's KEV, no public PoC exists, and EPSS assigns a 0.4% probability of exploitation within 30 days.

What to do: Upgrade nDPI to version 6.0 or later and rebuild or update every product that bundles it - including ntopng, nProbe, and any custom integration linking the library - since statically linked copies are not fixed by a library update alone. Inventory which sensors and analyzers in your environment use nDPI to inspect untrusted traffic and prioritize edge-facing ones. No workaround is known; treat unexplained crashes or restarts of packet-inspection processes as possible exploitation attempts.