EUVD-2026-86285
GHSA-hjcq-5876-2cpr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Crafted DNS network input parsed without auth or interaction (AV:N/AC:L/PR:N/UI:N); impact is process termination only (C:N/I:N/A:H), though A:H is realized mainly on strict-alignment or sanitizer builds.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
7DescriptionCVE.org
nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignment checks. This results in undefined behavior and can cause process termination in UBSan-instrumented builds or on strict-alignment architectures, leading to denial of service.
AnalysisAI
Crafted DNS traffic parsed by the nDPI 5.1.0 deep-packet-inspection library can terminate the hosting process wherever that code runs on a strict-alignment CPU (ARM, MIPS, SPARC and similar) or in an UndefinedBehaviorSanitizer/fuzzing build, because the DNS dissector and the serializer deserialization path dereference byte buffers at arbitrary packet offsets through uint16_t/uint32_t/uint64_t pointers without any alignment check. The flaw is remotely reachable and unauthenticated (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but impact is limited to availability - process termination, no confidentiality or integrity loss - and the decisive precondition is the build/CPU target: mainstream x86-64 release builds silently tolerate the misaligned load and generally will not crash. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to run nDPI 5.1.0 (or an embedding product/appliance) built for a strict-alignment CPU architecture (e.g., ARM, MIPS, SPARC) OR compiled with UndefinedBehaviorSanitizer / fuzzing instrumentation - this is the decisive limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5) frames this as a remotely-reachable, unauthenticated, low-complexity availability-only flaw, which is consistent with a crafted DNS packet reaching nDPI's DNS dissector. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - apply commits 6ce1280c52ed52a97332c3fe58fd2b47b867ec6e, 8fc3b439920021a77165f8aee4f81b25bc88629e, 694231bb43ff21f452fbc2b53fcf6cdc9a99f75f and 6698f14bf6025394a537fe23f413cf79e9d13594, or merge PR https://github.com/ntop/nDPI/pull/3231, then rebuild and re-vendor the library into any embedding product; verify the fix is present by confirming the get_u_int16_t/32/64 macros resolve to the memcpy-based ndpi_get_u_int* inline helpers and that ndpi_serializer is declared as a union with the ndpi_private_serializer alignment member and its _Static_assert. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all deployments of nDPI 5.1.0, especially those running on ARM, MIPS, SPARC, or UBSan/fuzzing builds, and assess exposure to untrusted DNS traffic; apply immediate compensating controls such as disabling the DNS dissector in nDPI, restricting DNS traffic to trusted sources, or temporarily migrating affected services to x86-64 if feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlle
In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/
In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_in
ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello. Rated high severity (CVSS 8.8), this vulner
In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protoc
In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positione
In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-aft
In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c. Rated critical severity (CV
In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/proto
Heap buffer overflow in ntop nDPI before version 6.0 allows unauthenticated network-adjacent or remote attackers to corr
nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c. Rated h
Same weakness CWE-1335 – Incorrect Bitwise Shift of Integer
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today