CVE-2026-97371 Details
Description
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260721, ndpi_get_custom_category_match writes a four-byte nDPI protocol-category value through a pointer to the two-byte id variable in IpAddress::reloadBlacklist in src/IpAddress.cpp during packet dissection and host initialization. A remote unauthenticated attacker on a monitored network segment can send packets that match custom-category rules, causing stack corruption and denial of service without user interaction. This issue is fixed in version 6.7.260721.
A stack-based buffer overflow vulnerability has been identified in ntopng versions prior to 6.7.260721. The issue arises in the nDPI library's custom category matching function, ndpi_get_custom_category_match, which is called during packet dissection and host initialization. This vulnerability allows a remote, unauthenticated attacker on a monitored network segment to send packets that match custom-category rules, leading to stack corruption and denial-of-service. The vulnerability is triggered when ntopng processes network packets that require protocol classification, causing the function to write a four-byte value into a two-byte variable, id, which partially overflows and corrupts the stack.
Users are advised to update to ntopng version 6.7.260721 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/ntop/ntopng/commit/96acb6187950a6a49ca827e49973c3e0c27ea664 | [email protected] | Source CodeVendor |
| https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-121 | Stack-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ntopng | <= 6.7.260720 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Nov 5, 2026 | New CVE Received | [email protected] |