{"id":"CVE-2026-116744","kind":"vulnerability","aliases":["CVE-2026-116744"],"related":[],"title":"nDPI: out-of-bounds read in SoftEther parser leaks memory from packets","description":"ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.","summary":"ntop's nDPI deep packet inspection library, through version 6.0, reads past the end of a packet buffer when parsing SoftEther host names. A remote attacker can send crafted short UDP datagrams on already-classified SoftEther flows to make the read go beyond the payload.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ndpi","network-monitoring","ntopng","package"],"not_affected_if":["no-ndpi-in-use","no-untrusted-udp-traffic"],"how_to_check":"- Check the nDPI version in use with `ndpi_get_api_version()` or the package manager record; versions through `6.0` are affected\n- Confirm whether the build includes the SoftEther dissector in `softether.c`","fix":"- Upgrade nDPI to a release newer than `6.0` that fixes `dissect_softether_host_fqdn()`; the sources do not name the fixed version\n- unknown","status":"open","published_at":"2026-10-26T22:16:58+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","triaged_at":"2026-10-26T22:27:45+00:00","updated_at":"2026-10-26T22:27:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T22:27:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade nDPI to a release newer than `6.0` that fixes `dissect_softether_host_fqdn()`; the sources do not name the fixed version\n- unknown","reach":"internet","title":"nDPI: out-of-bounds read in SoftEther parser leaks memory from packets","impact":"low","summary":"ntop's nDPI deep packet inspection library, through version 6.0, reads past the end of a packet buffer when parsing SoftEther host names. A remote attacker can send crafted short UDP datagrams on already-classified SoftEther flows to make the read go beyond the payload.","category":"package","nicknames":[],"who_cares":["ndpi","ntopng","network-monitoring"],"confidence":0.6,"needs_auth":"no","worst_case":"Out-of-bounds memory read from the packet buffer, possibly leaking nearby memory","analyst_note":"Find the fixed nDPI release and the upstream commit for softether.c at https://nvd.nist.gov/vuln/detail/CVE-2026-116744 or the ntop repository.","how_to_check":"- Check the nDPI version in use with `ndpi_get_api_version()` or the package manager record; versions through `6.0` are affected\n- Confirm whether the build includes the SoftEther dissector in `softether.c`","needs_analyst":true,"not_affected_if":["no-ndpi-in-use","no-untrusted-udp-traffic"],"who_is_affected":"Systems that run nDPI to classify network traffic, such as ntopng, nProbe or custom DPI pipelines, where UDP traffic from the internet reaches the inspection point. Teams that do not run nDPI, or run it only on closed internal links, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3351,"output_tokens":628,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116744':16A,19A '-2026':15A,18A '6.0':35B,75C 'alreadi':60B,114C 'already-classifi':59B,113C 'attack':51B,105C 'beyond':69B,122C 'bound':5A,81C 'buffer':43B,126C 'byte':98C 'caus':118C 'classifi':61B,115C 'compar':92C 'consum':97C 'contain':76C 'count':99C 'craft':54B,108C 'cve':14A,17A 'data':102C 'datagram':57B,111C 'deep':29B 'dissect':85C 'end':39B 'flow':63B,117C 'fqdn':88C 'go':68B 'host':47B,87C,93C 'inspect':31B 'instead':100C 'leak':10A 'length':103C 'librari':32B 'make':65B 'memori':11A 'monitor':23B 'name':48B,94C 'ndpi':1A,20B,28B,73C 'network':22B 'network-monitor':21B 'ntop':26B,72C 'ntopng':24B 'out-of-bound':2A,78C 'packag':25B 'packet':13A,30B,42B,124C 'pars':45B 'parser':9A 'past':37B 'payload':71B,125C 'read':6A,36B,67B,82C,121C 'remot':50B,104C 'send':53B,107C 'short':55B,109C 'softeth':8A,46B,62B,86C,116C 'softether.c':90C 'strncmp':119C 'udp':56B,110C 'use':95C 'version':34B 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Systems that run nDPI to classify network traffic, such as ntopng, nProbe or custom DPI pipelines, where UDP traffic from the internet reaches the inspection point. Teams that do not run nDPI, or run it only on closed internal links, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T22:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116744","severity":null,"published_at":"2026-10-26T22:16:58+00:00","modified_at":"2026-10-26T22:16:59+00:00","first_seen_at":"2026-10-26T22:25:34+00:00","fetched_at":"2026-10-26T22:25:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}