ntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets

Description

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260721, ndpi_get_custom_category_match writes a four-byte nDPI protocol-category value through a pointer to the two-byte id variable in IpAddress::reloadBlacklist in src/IpAddress.cpp during packet dissection and host initialization. A remote unauthenticated attacker on a monitored network segment can send packets that match custom-category rules, causing stack corruption and denial of service without user interaction. This issue is fixed in version 6.7.260721.

Scores

EPSS (exploitation in 30 days)

0.48% · top 58% of all CVEs (7 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-121: Stack-based Buffer Overflow (opens in a new tab)All about CWE-121 and its CVEs

Affected products

• ntop · ntopng

  • affected < 6.7.260721

References (2)

• https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7 (opens in a new tab)x_refsource_CONFIRMexploit
• https://github.com/ntop/ntopng/commit/96acb6187950a6a49ca827e49973c3e0c27ea664 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-97371](https://trackcve.app/badge/CVE-2026-97371.svg)](https://trackcve.app/cve/CVE-2026-97371)

Record last updated 5 Nov 2026, 20:57 UTC.