🔥 CyberForge CVE of the Day #044 🚨 CVE-2026-86098 — nDPI Heap Buffer Overflow via Attacker-Controlled Network Metadata. A security library designed to inspect hostile network traffic can itself become the vulnerable parser. ntop nDPI versions before 6.0 contain a High-severity out-of-bounds heap write inside `ndpi_json_string_escape()`. An unauthenticated attacker can place crafted content into network-visible metadata—including TLS Server Name Indication values, HTTP headers or DNS names. If an affected application extracts that data and passes it through nDPI’s vulnerable JSON serialisation path with insufficient output space, the escaping function can write beyond the caller-provided heap buffer. The confirmed result is heap corruption. Process termination and monitoring disruption are credible outcomes. Native heap corruption also creates potential for code execution—but no reliable end-to-end RCE exploit has been publicly demonstrated for this CVE. This distinction matters: ⚠️ CVE-2026-86098 is confirmed unauthenticated network-reachable heap corruption with conditional RCE potential—not proven universal remote code execution. 🔑 Key details: ⭐ Severity: High 📊 CVSS v4.0: 8.3 🧮 Vector: `CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N` 🧠 Weakness: CWE-787 — Out-of-bounds Write 🎯 Target: ntop nDPI 🧩 Component: `ndpi_json_string_escape()` 🌐 Attack vector: Network ⚙️ Attack complexity: High 🧱 Attack requirements: Present 🔓 Privileges required: None 👆 User interaction: None ⚔️ Confirmed impact: Heap corruption; High integrity and availability impact 💥 Potential impact: Process crash, telemetry loss and conditional code execution 🛡️ Fix: Upgrade to nDPI 6.0+ or a vendor-confirmed patched backport 🔧 Upstream fix: Commit `94e82c1de12323d992895830231865736a8abf2c` 🚫 Active exploitation: None publicly confirmed 🧪 Public PoC: Technical source and patch details are public; no credible weaponised exploit identified 📋 CISA KEV: Not listed when checked 6 September 2026 📉 EPSS: Approximately 0.35%, around the 28th percentile at review time 🧬 What actually went wrong? nDPI is an open-source deep-packet-inspection library. Applications embed it to identify protocols and extract useful metadata from network flows. That metadata may later be emitted as JSON for logging, APIs, event pipelines or analytics. JSON strings cannot contain every input byte literally. Quotes and backslashes require escaping, while control characters may be converted into longer Unicode escape sequences. A single input byte can expand into six output characters resembling: `\u00xx` An escaping function must therefore know the true capacity of its destination buffer and check that capacity before every write. The output may be substantially larger than the input. Before the fix, `ndpi_json_string_escape()` received source data and a destination pointer but lacked an enforceable maximum length for that destination. The routine would: 1️⃣ Write an opening quote. 2️⃣ Iterate through the source bytes. 3️⃣ Copy ordinary characters or expand special characters into JSON escapes. 4️⃣ Copy recognised multibyte UTF-8 sequences. 5️⃣ Write the closing quote and string terminator. If the calling application allocated less space than the attacker-controlled text required after escaping, the function could continue writing beyond the heap allocation. Adjacent application data or allocator metadata could then be overwritten. That is the heart of CVE-2026-86098: Output expansion without a trustworthy capacity boundary at the write sink. ⚔️ The practical attack chain: 1️⃣ An attacker identifies traffic that will cross a network path inspected by software containing vulnerable nDPI. 2️⃣ They place crafted bytes in protocol metadata such as TLS SNI, an HTTP header or a DNS name. 3️⃣ The packet reaches the target environment directly, through ordinary client/server communication, or indirectly through a SPAN/TAP feed, packet broker, PCAP or message pipeline. 4️⃣ The application submits the traffic to nDPI for protocol identification and metadata extraction. 5️⃣ The host application attempts to serialise the extracted attacker-controlled text into JSON. 6️⃣ The text reaches vulnerable `ndpi_json_string_escape()`. 7️⃣ JSON escaping expands the content beyond the capacity of the destination heap buffer. 8️⃣ The routine writes outside the allocation and corrupts heap memory. 9️⃣ The process may crash, emit corrupted output or enter unstable behaviour. 🔟 Conditional outcome: Under a favourable allocator, memory layout, call path and hardening posture, a skilled attacker may be able to develop the write into control-flow hijacking and code execution. The public evidence establishes steps one through eight. It does not provide a universal packet or proven reliable RCE chain for the final step. 🧱 Why the attack requirements matter: This is not automatically exploitable merely because a product links against nDPI. Two processing boundaries must align: 🔹 nDPI must extract attacker-controlled metadata from the observed traffic. 🔹 The host application must pass that value through the vulnerable JSON serialisation path with insufficient output space. The CVSS v4.0 assessment captures this through High Attack Complexity and Attack Requirements Present. The target’s allocator, compiler hardening, ASLR, non-executable memory, control-flow protections, process privileges, confinement and restart behaviour will also influence whether corruption stops at a crash or becomes something more serious. 🌍 Why this matters beyond one package: nDPI is a library, not merely a standalone daemon. An affected copy may be: 🔹 Installed as a shared operating-system package 🔹 Compiled statically into an executable 🔹 Vendored into another source repository 🔹 Embedded in a network-monitoring appliance 🔹 Shipped inside a container image 🔹 Forked or copied without an obvious package identity 🔹 Included beneath another ntop or third-party product Searching only for a process named `nDPI` will miss real exposure. Static linking creates a particularly troublesome trap. Updating the system’s shared `libndpi` package does not repair a program containing an older private copy inside its own binary. That application must be rebuilt and redeployed or replaced with a vendor-fixed release. This makes CVE-2026-86098 a software-composition and SBOM problem as much as a conventional patching problem. 📡 The passive-sensor paradox: A monitoring sensor does not need a public management interface to process attacker-controlled traffic. A passive sensor receiving mirrored network flows may still observe the attacker’s crafted TLS handshake, HTTP request or DNS traffic. If it extracts the metadata and serialises it through the vulnerable path, the attacker may reach the flaw without directly connecting to the sensor itself. The meaningful question is not simply: "Can the attacker reach a listening port on the sensor?" It is: "Can attacker-controlled traffic be observed and processed by a vulnerable nDPI consumer?" That distinction is vital for IDS, monitoring and flow-analysis infrastructure. 👁️ Availability has security value: Even if code execution proves impractical on a hardened deployment, a repeatable crash may still matter. A failed nDPI consumer could create: 🔹 Missing protocol classifications 🔹 Gaps in flow or security telemetry 🔹 Monitoring blind spots 🔹 Watchdog restart loops 🔹 Failed policy or traffic-control decisions 🔹 Queued work and resource exhaustion 🔹 Lost evidence during an active incident The effect depends on the embedding application. A standalone analytics worker may restart with limited impact. An inline or security-critical consumer may produce a substantially larger operational consequence. 🛠️ What the patch changes: Upstream commit `94e82c1de12323d992895830231865736a8abf2c` repairs the unsafe capacity contract. The security-relevant changes include: ✅ Supplying the destination’s maximum length to `ndpi_json_string_escape()` ✅ Reserving space for the closing quote and terminator ✅ Checking capacity before copying ordinary printable characters ✅ Checking before two-character and six-character escape expansions ✅ Checking before copying two-, three- or four-byte UTF-8 sequences ✅ Validating source length before reading look-ahead UTF-8 bytes ✅ Replacing invalid UTF-8 with U+FFFD when space permits ✅ Returning `-1` when the output cannot fit ✅ Updating callers to detect and propagate serialisation failure This is the correct architectural repair. The sink now knows the real buffer limit and refuses unsafe output instead of trusting every caller to predict worst-case expansion perfectly. 🛡️ Affected software and remediation: 🔴 Affected: nDPI versions before 6.0 🟢 Fixed: nDPI 6.0 or a downstream build confirmed to contain upstream commit `94e82c1...` or an equivalent backport Version numbers require care where Linux distributions or vendors backport security changes. A downstream package numbered below 6.0 may be safe if it contains the verified patch; conversely, a product version unrelated to nDPI’s numbering proves nothing about the embedded library. Defenders should obtain one or more of: 🔍 An SBOM 🔍 Package manifests 🔍 Build records 🔍 Vendor security statements 🔍 Binary dependency evidence 🔍 Source confirmation of the fixed API and bounds checks Rebuild statically linked applications against corrected source and verify the artefact actually running after remediation. 🔎 Defender hunting guide: No authoritative universal network signature exists for this vulnerability. The attacker-controlled field can appear in multiple protocols, and the dangerous outcome depends on a later application-specific JSON path. 1️⃣ Inventory obvious packages. Search servers, network sensors, appliances, containers and analysis systems for nDPI packages, shared libraries, development files and source builds. Check distribution security trackers for backports rather than relying solely on the displayed upstream version. 2️⃣ Find hidden embedded copies. Search SBOMs, source repositories, build systems and binary records for: 🔍 `libndpi` 🔍 `nDPI` 🔍 `ndpi_serializer.c` 🔍 `ndpi_json_string_escape` 🔍 The old function signature without a destination maximum 🔍 The upstream fixing commit Ask appliance and commercial-software vendors whether nDPI is present and which revision their current build contains. 3️⃣ Map the hostile data path. For each consumer, record: 🔹 Which interfaces, SPAN/TAP feeds, packet brokers, PCAPs or queues provide traffic 🔹 Whether internet-originating or low-trust traffic reaches the component 🔹 Whether TLS, HTTP or DNS metadata is extracted 🔹 Whether flow metadata is exported as JSON 🔹 The process account and container privileges 🔹 Whether a crash creates fail-open, fail-closed or blind-spot behaviour 4️⃣ Hunt process failures. Look for: 🔍 Segmentation faults in nDPI-consuming processes 🔍 Crash traces involving `ndpi_json_string_escape` or `ndpi_serializer.c` 🔍 Allocator errors such as heap corruption, invalid free or damaged chunk metadata 🔍 AddressSanitizer findings 🔍 Repeated container or service restarts 🔍 Sudden gaps in DPI, flow or security telemetry 🔍 Truncated or malformed JSON immediately before a failure 🔍 Several crashes associated with processing the same external traffic 5️⃣ Correlate the traffic. Where lawful and operationally safe, preserve traffic surrounding a suspected crash. Inspect nearby TLS ClientHello/SNI values, HTTP headers and DNS names for unusual lengths, control bytes, excessive escaping characters or malformed UTF-8. These are investigative clues, not proof. Legitimate traffic can contain unusual encodings, while a successful trigger may not require obviously extreme input. 6️⃣ Search for escalation beyond a crash. If the affected process exhibits unexpected execution rather than simple termination, investigate: 🔍 Child shells or interpreters 🔍 Executable-memory or control-flow protection alerts 🔍 Unexpected file creation or modification 🔍 New persistence 🔍 Altered monitoring configuration 🔍 Suspicious outbound network connections 🔍 Privilege changes 🔍 Disabled logging or unexplained evidence gaps These are conditional post-exploitation indicators. No public campaign confirms them for CVE-2026-86098. 🚑 Defensive action: ✅ Inventory every direct and embedded nDPI copy ✅ Upgrade to 6.0 or a verified patched backport ✅ Rebuild and redeploy statically linked consumers ✅ Obtain exposure statements from appliance vendors ✅ Restart affected applications and verify the running binary/image ✅ Review historical crashes, restart loops and telemetry gaps ✅ Run inspection processes with dedicated unprivileged accounts ✅ Remove unnecessary filesystem, device and network access ✅ Use container confinement, seccomp and AppArmor/SELinux where supported ✅ Preserve traffic and crash evidence surrounding failures Disabling one protocol or filtering one named field is not a dependable universal workaround. Multiple attacker-controlled metadata sources can reach the vulnerable sink, and every host application integrates nDPI differently. If exploitation is suspected, preserve crash dumps, logs, deployed binaries, package hashes, container state and relevant network evidence. Determine the exact nDPI revision and whether it is dynamically or statically linked. Distinguish a routine process crash from control-flow deviation or unexpected execution. If code execution cannot be excluded, rotate credentials available to the affected service and rebuild from a trusted patched source. 🧾 Evidence separation: Confirmed by the VulnCheck CNA. nDPI before 6.0 is affected; `ndpi_json_string_escape()` can write beyond caller-provided buffer boundaries; crafted TLS SNI, HTTP header or DNS-name data can reach the vulnerable function and cause heap corruption; CVSS v4.0 is 8.3; CWE-787 applies. Confirmed by the upstream patch: The earlier escaping interface lacked a destination maximum; the correction adds explicit capacity checks, safer UTF-8 handling, controlled overflow failure and caller error propagation. CyberForge interpretation: process crashes and loss of DPI telemetry are credible immediate consequences. Native heap corruption gives conditional code-execution potential, but exploitability depends upon the embedding application, allocation context and platform mitigations. Not established: reliable RCE, root execution, a universal packet trigger, active exploitation, a definitive list of affected commercial appliances, a named threat actor or a campaign. 🔥 CyberForge verdict: CVE-2026-86098 is a superb reminder that software deployed for visibility can itself become an attack surface. nDPI sits on a hostile boundary by design. It examines fields selected by remote systems, and those fields remain attacker-controlled no matter how descriptive they appear. The defect crosses a second trust boundary when extracted text is converted to JSON without the escaping function knowing the real capacity of its destination. One-byte input becoming a six-character escape is enough to turn a casual allocation assumption into heap corruption. The risk should neither be understated nor inflated. This is confirmed unauthenticated heap corruption in native C code. A crash may impair monitoring or policy enforcement. Code execution is technically plausible—but the public evidence does not prove a reliable RCE chain. The defensive priority is clear: 1️⃣ Discover every nDPI copy, including static and appliance-embedded builds. 2️⃣ Map which consumers serialise hostile metadata into JSON. 3️⃣ Upgrade or backport the upstream bounds fix. 4️⃣ Verify the running artefact, not merely the build pipeline. 5️⃣ Hunt historical crashes and visibility gaps. The one-sentence CyberForge verdict: A library that inspects hostile traffic must treat every extracted hostname and header as adversarial input—upgrade nDPI and every embedded consumer before a heap overwrite becomes either a monitoring blind spot or an exploit foothold. 🔗 CNA advisory: https://www.vulncheck.com/advisories/ntop-ndpi-before-6.0-heap-buffer-overflow-via-ndpi-json-string-escape 🔗 Upstream fix: https://github.com/ntop/nDPI/commit/94e82c1de12323d992895830231865736a8abf2c 🔗 Full visual advisory: https://github.com/advisories/GHSA-c8vx-3h2j-4f8m 🔗 Full vulnerability details: https://nvd.nist.gov/vuln/detail/CVE-2026-86098 #CyberSecurity #CVE #nDPI #ntop #DeepPacketInspection #HeapBufferOverflow #MemorySafety #NetworkSecurity #SBOM #ThreatHunting #BlueTeam #CyberForge
Post summary
CVE‑2026‑86098 is a high‑severity out‑of‑bounds heap write in nDPI’s JSON escape routine, with conditional RCE potential but no public exploitation. The advisory details the issue, provides a patch (upgrade to 6.0 or backport) and extensive mitigation guidance.
