ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 6.9NVD modified 2026-10-26 22:16
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://github.com/ntop/nDPI
- https://github.com/ntop/nDPI/blob/6.0/src/lib/protocols/softether.c#L203
- https://github.com/ntop/nDPI/commit/ca9d819151606377ac53305583fe819748c69be2
- https://github.com/ntop/nDPI/issues/3291
- https://github.com/ntop/nDPI/pull/3298
- https://hackmd.io/@haindpwn/ndpi-softether-host-fqdn-strncmp-oob-read
- https://www.vulncheck.com/advisories/ntop-ndpi-through-6.0-out-of-bounds-read-in-softether-dissector