CVE-2026-116744 in nDPI
Summary
by MITRE • 10/27/2026
ntop nDPI through 6.0 contains an out-of-bounds read vulnerability in dissect_softether_host_fqdn() in softether.c that compares host_name using the consumed byte count instead of data length. Remote attackers can send crafted short UDP datagrams on already-classified SoftEther flows, causing strncmp to read beyond the packet payload buffer.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within ntop's nDPI library version 6.0 and earlier represents a critical memory safety flaw located in the softether protocol dissection logic. Specifically, the function dissect_softether_host_fqdn() contains an out-of-bounds read condition that arises from incorrect length validation during packet parsing. When processing SoftEther traffic, which is often encapsulated within UDP datagrams, the application relies on a comparison between host_name and consumed byte counts rather than the actual data length available in the buffer. This logical error creates a scenario where the strncmp function may be instructed to read memory beyond the boundaries of the allocated packet payload buffer if it encounters crafted short UDP packets that have already been classified as belonging to SoftEther flows.
From a technical perspective, this flaw is categorized under CWE-125, which describes an out-of-bounds read vulnerability. The root cause lies in the failure to validate the remaining data length against the size of the string operation being performed. By using consumed byte counts instead of the total available data length for boundary checks, the application fails to ensure that the memory region accessed by strncmp remains within the valid bounds of the packet buffer. This discrepancy allows an attacker who can inject or manipulate network traffic to trigger a read access violation outside the intended memory space. Such behavior is particularly dangerous because it does not necessarily result in immediate code execution but rather leads to information disclosure through potential leakage of adjacent heap or stack data, which could contain sensitive credentials, session tokens, or other confidential information stored nearby in memory.
The operational impact of this vulnerability extends beyond simple application crashes or denial-of-service conditions. While a crash is possible if the out-of-bounds read accesses unmapped memory pages, leading to an availability issue, the primary risk lies in data exfiltration and reconnaissance. An attacker leveraging this flaw can potentially extract arbitrary bytes from the process memory space by carefully crafting UDP datagrams that exploit the length miscalculation. This capability aligns with ATT&CK technique T1046, Network Service Discovery, as it allows an adversary to probe internal systems for sensitive information without direct access to the host operating system. Furthermore, if the leaked data includes cryptographic keys or authentication tokens, the confidentiality of communications protected by SoftEther is compromised, undermining the security posture of networks relying on this protocol for secure tunneling.
Mitigation strategies must address both immediate remediation and long-term defensive postures. The most effective solution is to apply vendor-provided patches that update nDPI to a version where dissect_softether_host_fqdn() correctly validates buffer lengths using data length metrics rather than consumed byte counts. Until such updates are applied, network administrators should consider restricting access to the affected service by implementing strict firewall rules that limit UDP traffic on relevant ports to trusted sources only. Additionally, deploying intrusion detection systems with signatures capable of identifying anomalous packet sizes or malformed protocol headers can help detect exploitation attempts in real-time. Regular security audits and static code analysis tools configured to detect CWE-125 patterns are also recommended to prevent similar memory safety issues from being introduced into the application logic during future development cycles.