Is CVE-2026-86098 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-86098?

CVE-2026-86098 has a CVSS v3 severity of HIGH (7.4).

Back

CVE-2026-86098

Description

ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger the overflow by supplying crafted network packet data including TLS SNI, HTTP headers, or DNS names that reach the vulnerable function, causing heap corruption.