Heap Buffer Overflow Vulnerability in nDPI Package
Summary
OSV-2025-564: Heap-buffer-overflow in ndpi_match_host_subprotocol. Affects ndpi versions >= 61d152778d6329350ccf5acb063d6ffc3fd1b366, < ae48c8df7a7b01e67838572621b758e4b2d966ec. Fixed in ae48c8df7a7b01e67838572621b758e4b2d966ec. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nDPI (ntop Deep Packet Inspection) is an open-source software library designed for deep packet inspection and network traffic analysis. It enables applications to identify and classify network protocols, providing insights into network usage and security. However, like many software libraries, nDPI is susceptible to vulnerabilities that can be exploited if not properly addressed.
Vulnerability Detail
The vulnerability identified as OSV-2025-564 is a heap-buffer-overflow that occurs in the function ndpi_match_host_subprotocol. This issue can lead to a crash of the application, potentially allowing an attacker to exploit the overflow to execute arbitrary code or cause denial of service. The vulnerability was introduced in the codebase and has been assigned a high severity rating due to its potential impact on system stability and security.
How To Fix
Minimum fixed version
ae48c8df7a7b01e67838572621b758e4b2d966ec
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider limiting the input size to the ndpi_match_host_subprotocol function to prevent the overflow from occurring. However, this is not a permanent solution and should only be used until the package can be updated.
Conclusion
The heap buffer overflow vulnerability in the nDPI package poses significant risks to applications utilizing this library. It is crucial to update to the patched version to ensure the security and stability of your software. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for ndpi →
FAQ
A heap buffer overflow occurs when a program writes more data to a buffer located on the heap than it can hold, potentially overwriting adjacent memory and leading to unpredictable behavior.
Exploiting this vulnerability could allow an attacker to crash your application or execute arbitrary code, compromising the security and stability of your system.
Yes, a patch is available in the fixed version ae48c8df7a7b01e67838572621b758e4b2d966ec. It is recommended to update to this version to mitigate the risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package immediately, consider implementing input size limitations as a temporary workaround until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for ndpi.
