Live › vulnerability › CVE-2026-116744
Go to dashboardntop's nDPI deep packet inspection library, through version 6.0, reads past the end of a packet buffer when parsing SoftEther host names. A remote attacker can send crafted short UDP datagrams on already-classified SoftEther flows to make the read go beyond the payload.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Systems that run nDPI to classify network traffic, such as ntopng, nProbe or custom DPI pipelines, where UDP traffic from the internet reaches the inspection point. Teams that do not run nDPI, or run it only on closed internal links, can skip it.
No product ranges from the sources yet.
ndpi_get_api_version() or the package manager record; versions through 6.0 are affectedsoftether.c6.0 that fixes dissect_softether_host_fqdn(); the sources do not name the fixed versionEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.
This page as .md · .json · in your agent: get_signal("CVE-2026-116744")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.