Out-of-Bounds Read Vulnerability in ntop nDPI Affected by UDP Packet Manipulation
CVE-2026-116744

6.9MEDIUM

Key Information:

Vendor

Ntop

Status
Ndpi
Vendor
CVE Published:
26 October 2026

What is CVE-2026-116744?

The ntop nDPI product, through version 6.0, exhibits an out-of-bounds read vulnerability within the dissect_softether_host_fqdn() function in softether.c. This issue arises because the function erroneously compares the host_name using the consumed byte count rather than the expected data length. Exploiting this vulnerability, a remote attacker can send crafted short UDP datagrams over already-classified SoftEther flows, leading to potential memory access violations as strncmp reads beyond the payload buffer.

Affected Version(s)

nDPI 0 <= 6.0

References

https://github.com/ntop/nDPI/pull/3298
issue-trackingpatch
https://github.com/ntop/nDPI/commit/ca9d819151606377ac533...
patch
https://github.com/ntop/nDPI
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

HaiND from the Post and Telecommunication Institute of Technology
IvanNardi
.