CVE-2026-97371

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260721, ndpi_get_custom_category_match writes a four-byte nDPI protocol-category value through a pointer to the two-byte id variable in IpAddress::reloadBlacklist in src/IpAddress.cpp during packet dissection and host initialization. A remote unauthenticated attacker on a monitored network segment can send packets that match custom-category rules, causing stack corruption and denial of service without user interaction. This issue is fixed in version 6.7.260721.

• CWE-121

• https://github.com/ntop/ntopng/commit/96acb6187950a6a49ca827e49973c3e0c27ea664
• https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7
• https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-97363The WebSocket Application Programming Interface lacks restri…7.5
• CVE-2026-97365A vulnerability was determined in chonkie-inc littrs 0.6.1/0…6.3
• CVE-2026-97366A security flaw has been discovered in jhen0409 react-native…6.3
• CVE-2026-97368A weakness has been identified in chillzhuang SpringBlade up…6.3
• CVE-2026-9737During query planning when reading the sort pattern in raw B…6.5
• CVE-2026-97370Junrar is an open source Java RAR archive library. Prior to …7.5
• CVE-2026-97373draw.io is a configurable diagramming and whiteboarding appl…5.8
• CVE-2026-97377SuiteCRM is an open-source, enterprise-ready Customer Relati…8.8
• CVE-2026-9738The Print, PDF, Email by PrintFriendly plugin for WordPress …4.4
• CVE-2026-97380MariaDB server is a community developed fork of MySQL server…8.8
• CVE-2026-97381Legacy Update is a tool for activating and installing update…9.9
• CVE-2026-97387Rejected reason: This CVE is a duplicate of another CVE.