Description
ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.
Published: 2026-10-26
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Data Exposure
Action: Patch
AI Analysis

Impact

ntop nDPI through version 6.0 includes an out‑of‑bounds read in the function dissect_softether_host_fqdn(). A remote attacker can send specially crafted short UDP datagrams over already‑classified SoftEther flows, causing the string comparison routine to read past the end of the packet buffer. This can expose internal memory contents and potentially lead to data disclosure. The weakness is formally recorded as CWE‑125.

Affected Systems

The vulnerability affects the ntop nDPI product, specifically releases up to and including version 6.0. Any deployment that relies on this version for SoftEther packet analysis is potentially impacted.

Risk and Exploitability

The CVSS score for this issue is 6.9, indicating a medium severity. The EPSS score is not currently available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation data. Attackers can gain the vulnerability by sending crafted UDP packets, with no authentication required, making the attack vector remote and potentially automated.

Generated by OpenCVE AI on October 27, 2026 at 08:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update ntop nDPI to a version that contains the fix for the SoftEther out-of-bounds read (e.g., the latest release following the commit ca9d819).
  • If an immediate upgrade is not possible, limit UDP traffic on the ports used by SoftEther flows to trusted sources or apply firewall rules that block anomalous short packets.
  • Continuously monitor network traffic for unusual short UDP packets that could trigger the defect, and set up alerts or automated mitigation actions accordingly.

Generated by OpenCVE AI on October 27, 2026 at 08:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Description ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.
Title ntop nDPI through 6.0 Out-of-Bounds Read in SoftEther Dissector
First Time appeared Ntop
Ntop ndpi
Weaknesses CWE-125
CPEs cpe:2.3:a:ntop:ndpi:*:*:*:*:*:*:*:*
Vendors & Products Ntop
Ntop ndpi
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Ntop Ndpi
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T21:52:42.875Z

Reserved: 2026-10-26T20:23:36.908Z

Link: CVE-2026-116744

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-26T22:16:58.963

Modified: 2026-10-26T22:16:59.083

Link: CVE-2026-116744

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T08:15:15Z

Weaknesses