ntop nDPI CVE-2026-86098

The nDPI library must be actively inspecting live or replayed network traffic that reaches the ndpi_json_string_escape serialization path - specifically flows containing TLS SNI strings, HTTP headers (Host, User-Agent, etc.), or DNS query names. The vulnerability is triggered when those strings contain characters whose JSON escape representation is longer than a single byte (backslash, double-quote, slash, control characters 0x00-0x1F, DEL 0x7F) in sufficient density to exhaust the destination buffer before the loop terminates. No authentication, local access, or special operator configuration is required - any attacker who can cause crafted packets to traverse the monitored network link can trigger the overflow. Exploitation is constrained by the requirement to craft input that produces the right escape expansion ratio against the specific buffer size allocated by the caller; this makes the attack non-trivial but well within reach for a motivated adversary with network access to the monitored segment.

The provided CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H) appropriately characterizes this as a high-complexity, unauthenticated network-reachable flaw with no confidentiality impact but significant integrity and availability consequences from heap corruption. The AC:H and AT:P ratings reflect that exploitation requires crafted packet content to reach the serializer with specifically problematic byte sequences, which is more than trivial but entirely feasible for any attacker controlling or injecting network traffic that the nDPI-instrumented sensor observes. EPSS data is not provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis; however, the attack surface is passive - any network traffic the library inspects is a potential delivery vector, meaning even a mid-sized network operations team in gdynia should treat this as urgent given that nDPI sensors are often positioned at high-traffic chokepoints. The heap-corruption outcome (VI:H/VA:H) suggests the practical worst-case is process crash of the monitoring daemon, though exploitation for code execution cannot be excluded without further triage. No EPSS score was supplied in the input, so exploitation probability relative to peers cannot be benchmarked.

An attacker transmitting network traffic that the nDPI sensor passively monitors sends a TLS ClientHello with a crafted SNI value containing a dense sequence of characters that each require multi-byte JSON escapes (e.g., a string composed of backslashes, control characters, and DEL bytes). When nDPI classifies the flow and calls ndpi_json_string_escape to serialize the SNI into a JSON flow record, the expanded escape output overruns the heap-allocated destination buffer, corrupting adjacent heap metadata. Depending on heap layout, this can crash the monitoring daemon or be further developed into controlled code execution.