Description

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-04T23:18:03.687Z",
  "pubdate": "2026-09-04T23:18:03.687Z",
  "executiveSummary": "A heap-based buffer overflow vulnerability exists within the ndpi_json_string_escape function of ntop nDPI versions prior to 6.0. This flaw allows an unauthenticated remote attacker to cause memory corruption by providing specially crafted network traffic, such as malicious TLS SNI, HTTP headers, or DNS queries.\nThe vulnerability originates from improper bounds checking during the string escaping process, which facilitates writes outside the allocated memory region. Successful exploitation can lead to a crash of the nDPI-dependent service or potentially facilitate arbitrary code execution, depending on the heap layout and attacker control over the overflowed memory.\nGiven that nDPI is frequently utilized in network monitoring, traffic analysis, and security appliances, this vulnerability poses a significant risk to high-availability network infrastructure. The exploitation vector is strictly network-based, requiring the target system to process attacker-controlled packets. No local access or authentication is necessary to trigger the vulnerability, as it manifests during the routine parsing of network protocol metadata.",
  "technicalDetails": "The root cause of the vulnerability is an insufficient validation of buffer boundaries within the ndpi_json_string_escape function. This function is responsible for sanitizing strings for JSON output by escaping special characters; however, it fails to verify that the destination buffer is of sufficient size to hold the resulting escaped string and the appended metadata.\nThe attack flow begins when the nDPI library parses incoming network traffic. An attacker encapsulates a malicious payload within fields that are subsequently processed by the library, such as the TLS Server Name Indication (SNI) field, specific HTTP header values, or DNS domain names. When these fields are passed to ndpi_json_string_escape for serialization, the function attempts to write the escaped character sequence into a heap-allocated buffer.\nIf the input string contains a high density of characters requiring escaping (e.g., backslashes, quotes, or control characters), the output buffer exceeds its pre-allocated capacity. Because the internal boundary checking logic is flawed, the function continues to write beyond the end of the heap chunk. This results in the corruption of adjacent heap metadata or adjacent heap objects.\nExploitation involves precise manipulation of the heap layout. By carefully crafting the input length and content, an attacker may be able to overwrite heap control structures, such as chunk headers or function pointers in objects residing on the heap. While nDPI is typically used for read-only traffic inspection, applications that integrate nDPI—such as traffic classifiers or deep packet inspection firewalls—may use the output of this function to update local state or log events, potentially providing an execution path for the attacker.\nThe affected versions include all releases of nDPI prior to 6.0. The vulnerability is highly exposed in any network-facing implementation that relies on nDPI to parse external protocol traffic. Successful exploitation results in a heap-based memory corruption event which, at a minimum, results in an application crash (Denial of Service). In scenarios where the heap state can be groomed, it may be feasible to achieve remote code execution (RCE) by hijacking control flow through corrupted pointers, granting the attacker the privileges of the process running the nDPI-based application."
}