Source: ndpi Version: 4.2-2.1 Severity: important Tags: security upstream Forwarded: https://github.com/ntop/nDPI/issues/3213 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi, The following vulnerability was published for ndpi. CVE-2026-88357[0]: | nDPI 5.1.0 contains a memory access issue in the DNS dissector and | serializer deserialization code. Specially crafted network input can | cause byte-buffer addresses at odd offsets to be cast to uint16_t or | wider integer pointers and directly dereferenced without alignment | checks. This results in undefined behavior and can cause process | termination in UBSan-instrumented builds or on strict-alignment | architectures, leading to denial of service. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-88357 https://www.cve.org/CVERecord?id=CVE-2026-88357 [1] https://github.com/ntop/nDPI/issues/3213 [2] https://github.com/ntop/nDPI/pull/3231 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
