CVE-2026-86098

HighCVSS 7.4/10Last modified Sep 23, 2026

Description

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Sep 4, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-860998.2Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse CVE-2026-86104.3The TypeSquare Webfonts for ConoHa plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.0.4. T CVE-2026-861006.4Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature.CVE-2026-861016.5An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access CVE-2026-861029.3An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute CVE-2026-861047.5An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to c CVE-2026-861057.1An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal u CVE-2026-861069.6An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. Th CVE-2026-861075.9The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated over CVE-2026-861088.0Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized ma CVE-2026-861096.6The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does CVE-2026-86114.3The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including