Ndpi
Monthly
Crafted DNS traffic parsed by the nDPI 5.1.0 deep-packet-inspection library can terminate the hosting process wherever that code runs on a strict-alignment CPU (ARM, MIPS, SPARC and similar) or in an UndefinedBehaviorSanitizer/fuzzing build, because the DNS dissector and the serializer deserialization path dereference byte buffers at arbitrary packet offsets through uint16_t/uint32_t/uint64_t pointers without any alignment check. The flaw is remotely reachable and unauthenticated (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but impact is limited to availability - process termination, no confidentiality or integrity loss - and the decisive precondition is the build/CPU target: mainstream x86-64 release builds silently tolerate the misaligned load and generally will not crash. It is not listed in CISA KEV and no public exploit identified at time of analysis, although the upstream fix PR does ship fuzz corpus inputs (issue3213_trigger1-3) that reproduce the fault, and EPSS data was not available for this record.
Heap buffer overflow in ntop nDPI before version 6.0 allows unauthenticated network-adjacent or remote attackers to corrupt process heap memory by sending crafted packets containing TLS SNI values, HTTP headers, or DNS names with characters that expand during JSON escaping. The root cause in ndpi_json_string_escape (src/lib/ndpi_serializer.c) is that the original bounds check guarded only single-byte writes while escape sequences requiring 2 bytes (e.g., backslash-quote) or 6 bytes (e.g., \u00XX control-character escapes) silently overran the caller-supplied buffer. Vendor-released patch is available via commit 94e82c1 targeting the 6.0 release; no public exploit has been identified at time of analysis.
An out-of-bounds read in nDPI's SoftEther dissector (dissect_softether_host_fqdn() in softether.c, all versions through 6.0) lets remote, unauthenticated attackers crash or destabilize a DPI engine that is inspecting traffic. The flaw is only reachable once nDPI has already classified a flow as SoftEther: the attacker then sends a crafted short or truncated SoftEther UDP datagram so that the consumed byte count passed to strncmp exceeds the real payload length, and the comparison runs past the end of the packet buffer. Impact is limited to availability of the monitoring process (no confidentiality or integrity effect), and the precondition of an existing classified SoftEther flow constrains opportunistic abuse; EPSS is low at 0.43% (37th percentile), there is no KEV listing, and no working exploit code appears in the available data, although a public technical write-up of the bug exists.
nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c. Rated high severity (CVSS 8.1), this vulnerability is no authentication required.
ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH protocol messages on a network segment. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Crafted DNS traffic parsed by the nDPI 5.1.0 deep-packet-inspection library can terminate the hosting process wherever that code runs on a strict-alignment CPU (ARM, MIPS, SPARC and similar) or in an UndefinedBehaviorSanitizer/fuzzing build, because the DNS dissector and the serializer deserialization path dereference byte buffers at arbitrary packet offsets through uint16_t/uint32_t/uint64_t pointers without any alignment check. The flaw is remotely reachable and unauthenticated (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5), but impact is limited to availability - process termination, no confidentiality or integrity loss - and the decisive precondition is the build/CPU target: mainstream x86-64 release builds silently tolerate the misaligned load and generally will not crash. It is not listed in CISA KEV and no public exploit identified at time of analysis, although the upstream fix PR does ship fuzz corpus inputs (issue3213_trigger1-3) that reproduce the fault, and EPSS data was not available for this record.
Heap buffer overflow in ntop nDPI before version 6.0 allows unauthenticated network-adjacent or remote attackers to corrupt process heap memory by sending crafted packets containing TLS SNI values, HTTP headers, or DNS names with characters that expand during JSON escaping. The root cause in ndpi_json_string_escape (src/lib/ndpi_serializer.c) is that the original bounds check guarded only single-byte writes while escape sequences requiring 2 bytes (e.g., backslash-quote) or 6 bytes (e.g., \u00XX control-character escapes) silently overran the caller-supplied buffer. Vendor-released patch is available via commit 94e82c1 targeting the 6.0 release; no public exploit has been identified at time of analysis.
An out-of-bounds read in nDPI's SoftEther dissector (dissect_softether_host_fqdn() in softether.c, all versions through 6.0) lets remote, unauthenticated attackers crash or destabilize a DPI engine that is inspecting traffic. The flaw is only reachable once nDPI has already classified a flow as SoftEther: the attacker then sends a crafted short or truncated SoftEther UDP datagram so that the consumed byte count passed to strncmp exceeds the real payload length, and the comparison runs past the end of the packet buffer. Impact is limited to availability of the monitoring process (no confidentiality or integrity effect), and the precondition of an existing classified SoftEther flow constrains opportunistic abuse; EPSS is low at 0.43% (37th percentile), there is no KEV listing, and no working exploit code appears in the available data, although a public technical write-up of the bug exists.
nDPI through 4.12 has a potential stack-based buffer overflow in ndpi_address_cache_restore in lib/ndpi_cache.c. Rated high severity (CVSS 8.1), this vulnerability is no authentication required.
ntop nDPI 3.4 has a stack-based buffer overflow in processClientServerHello. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In nDPI through 3.2, the Oracle protocol dissector has a heap-based buffer over-read in ndpi_search_oracle in lib/protocols/oracle.c. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In nDPI through 3.2, ndpi_reset_packet_line_info in lib/ndpi_main.c omits certain reinitialization, leading to a use-after-free. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
In nDPI through 3.2, there is a stack overflow in extractRDNSequence in lib/protocols/tls.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.
In nDPI through 3.2, the OpenVPN dissector is vulnerable to a heap-based buffer over-read in ndpi_search_openvpn in lib/protocols/openvpn.c. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
In nDPI through 3.2, the packet parsing code is vulnerable to a heap-based buffer over-read in ndpi_parse_packet_line_info in lib/ndpi_main.c. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In nDPI through 3.2 Stable, an out-of-bounds read in concat_hash_string in ssh.c can be exploited by a network-positioned attacker that can send malformed SSH protocol messages on a network segment. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.