CVE-2026-86098
Last modified
CVE-2026-86098 is a high-severity vulnerability rated 7.4/10 on the CVSS scale. ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.. EPSS estimates a 0.35% chance of exploitation in the next 30 days.
Description
ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| ntop | nDPI | < 6.0 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-86098?
How severe is CVE-2026-86098?
How do I fix CVE-2026-86098?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-86090ntopng before 6.7.260717 fails to perform authorization chec…7.1
- CVE-2026-86091ntopng before 6.7.260717 fails to check user privileges in t…7.1
- CVE-2026-86093IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 cou…7.5
- CVE-2026-86095Unidata netcdf-c through 4.10.1 contains an out-of-bounds wr…7.8
- CVE-2026-86096PX4 Autopilot through 1.17.0 contains a use-after-free vulne…5.9
- CVE-2026-86097PX4 Autopilot through 1.17.0 contains a null pointer derefer…6.5
- CVE-2026-86099Chainlit through 2.12.0 fails to validate the client-supplie…8.2
- CVE-2026-8610The TypeSquare Webfonts for ConoHa plugin for WordPress is v…4.3
- CVE-2026-86100Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate r…6.4
- CVE-2026-86101An improper authorization vulnerability in WatchGuard Firewa…6.5
- CVE-2026-86102An OS command injection vulnerability in the WatchGuard AP i…9.3
- CVE-2026-86104An uncontrolled resource consumption vulnerability in the Fi…7.5
Are you affected by CVE-2026-86098?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST