{"affected":[{"product":"ntopng","source":"CNA: GitHub_M","vendor":"ntop","versions":[{"status":"affected","version":"< 6.7.260721"}]}],"cveId":"CVE-2026-97371","cwes":["CWE-121"],"description":"ntopng is a web-based network traffic monitoring application. Prior to 6.7.260721, ndpi_get_custom_category_match writes a four-byte nDPI protocol-category value through a pointer to the two-byte id variable in IpAddress::reloadBlacklist in src/IpAddress.cpp during packet dissection and host initialization. A remote unauthenticated attacker on a monitored network segment can send packets that match custom-category rules, causing stack corruption and denial of service without user interaction. This issue is fixed in version 6.7.260721.","epss":null,"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}],"modifiedAt":1793912258887,"publishedAt":1793894760745,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/ntop/ntopng/commit/96acb6187950a6a49ca827e49973c3e0c27ea664"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/ntop/ntopng/security/advisories/GHSA-26jm-9qfw-89w7"}],"remediation":[],"revision":"eee5a43f1dda94f3e608ef04757aa6381788f86b525fa0b96844f4817d17219a","sources":[{"modifiedAt":1793912258887,"name":"CNA: GitHub_M","retrievedAt":1793913879314,"url":"https://www.cve.org/CVERecord?id=CVE-2026-97371"}],"ssvc":{"assessedAt":1793912240546,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"ntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets","updatedAt":1793913879314}