{"id":"CVE-2026-88357","details":"nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignment checks. This results in undefined behavior and can cause process termination in UBSan-instrumented builds or on strict-alignment architectures, leading to denial of service.","modified":"2026-09-26T08:10:32.737127Z","published":"2026-09-24T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88357.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88357.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88357"},{"type":"REPORT","url":"https://github.com/ntop/nDPI/issues/3213"},{"type":"FIX","url":"https://github.com/ntop/nDPI/pull/3231"},{"type":"FIX","url":"https://github.com/utoni/nDPI/commit/6698f14bf6025394a537fe23f413cf79e9d13594"},{"type":"FIX","url":"https://github.com/utoni/nDPI/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f"},{"type":"FIX","url":"https://github.com/utoni/nDPI/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e"},{"type":"FIX","url":"https://github.com/utoni/nDPI/commit/8fc3b439920021a77165f8aee4f81b25bc88629e"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/utoni/ndpi","events":[{"introduced":"0"},{"fixed":"6698f14bf6025394a537fe23f413cf79e9d13594"},{"fixed":"694231bb43ff21f452fbc2b53fcf6cdc9a99f75f"},{"fixed":"6ce1280c52ed52a97332c3fe58fd2b47b867ec6e"},{"fixed":"8fc3b439920021a77165f8aee4f81b25bc88629e"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"vanir_signatures_modified":"2026-09-26T08:10:32Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["317261641934007957187331818082608460978","314383203782760101538147942172329456514","168916711615451676731458660488018187556","89867862496985500416721213944030544868","265126449386432336967196269844749292800","238691010401678187662239018275730067049","157379003960321107652526723133018644137","303943770297133141663227895377085089573","106659452629216698533266268766395734867"],"threshold":0.9},"id":"CVE-2026-88357-0d6731d7","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594","target":{"file":"src/include/ndpi_typedefs.h"}},{"digest":{"line_hashes":["42160032179911239831608265827765078743","338583755732524209678601168035557957271","321542332313300494904823497059233363525","123372051143456563951063429732099601644","81666197492059997191019334081155952827","263482333039876437875848180782702213839","310958892337628186104282140022377262671","167089886877565100137662231015666226960"],"threshold":0.9},"id":"CVE-2026-88357-17e7ca5e","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594","target":{"file":"src/lib/protocols/blizzard.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"17816041334710858668752149242313840382","length":1782},"id":"CVE-2026-88357-259950bb","signature_type":"Function","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594","target":{"file":"src/lib/protocols/blizzard.c","function":"search_blizzard_tcp"}},{"target":{"file":"example/reader_util.h"},"deprecated":false,"digest":{"line_hashes":["82851453246988689168974440282106520829","289685842288647018145892966052073791012","83836126244643903745241794440041012558","24439637271742335531267014424645442993"],"threshold":0.9},"id":"CVE-2026-88357-3568e295","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594"},{"signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594","target":{"file":"src/lib/protocols/dns.c","function":"get16"},"deprecated":false,"digest":{"function_hash":"185016895312057313366263653345899416276","length":162},"id":"CVE-2026-88357-505884c2","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e","target":{"file":"src/lib/ndpi_analyze.c","function":"ndpi_print_ranking"},"deprecated":false,"digest":{"function_hash":"211109787713200289004537938042141295150","length":1001},"id":"CVE-2026-88357-51434736","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["156476060102533669446747795553766400207","213540146702219366897232270306381035847","117293049175567953106776075729698701873","127147343712444085478154974541650754424","271405891977349242200611426138317403426","70449238329207778256071712619870828854","108296065469110464826932263037840809117","262691485673553516672681757884641532862"],"threshold":0.9},"id":"CVE-2026-88357-5420bbba","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e","target":{"file":"src/lib/ndpi_analyze.c"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594","target":{"function":"is_stun","file":"src/lib/protocols/stun.c"},"deprecated":false,"digest":{"length":8083,"function_hash":"1735987685962774120708995386265071274"},"id":"CVE-2026-88357-5e47c5ca"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594","target":{"function":"ndpi_print_ranking","file":"src/lib/ndpi_analyze.c"},"deprecated":false,"digest":{"function_hash":"211109787713200289004537938042141295150","length":1001},"id":"CVE-2026-88357-5eebab27"},{"target":{"file":"src/include/ndpi_typedefs.h"},"deprecated":false,"digest":{"line_hashes":["238691010401678187662239018275730067049","157379003960321107652526723133018644137","303943770297133141663227895377085089573","106659452629216698533266268766395734867"],"threshold":0.9},"id":"CVE-2026-88357-61403bf9","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f"},{"id":"CVE-2026-88357-6c2c35cd","signature_type":"Function","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/8fc3b439920021a77165f8aee4f81b25bc88629e","target":{"file":"src/lib/ndpi_analyze.c","function":"ndpi_ranking_add_epoch"},"deprecated":false,"digest":{"function_hash":"61183990946857988085144540760125598980","length":1979}},{"signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594","target":{"file":"src/lib/protocols/dns.c"},"deprecated":false,"digest":{"line_hashes":["96473076024061932099890413838224763713","254263696223929072825593113044019317278","159350119412950410548266606503959342143","332682917349034201501933201549862062431","109622405245285929987100908918150110632","245209985858621998190987040364295939204","139703793955197405056635158522442740206","49781887060437207648840945805454065524","30847599263301406418823241094467200122","16149156684663778532629618352467197204","195404444311580519271477396607881741097","225061825511982711178624285251509344811"],"threshold":0.9},"id":"CVE-2026-88357-6d715979","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f","target":{"file":"src/lib/ndpi_analyze.c","function":"ndpi_print_ranking"},"deprecated":false,"digest":{"function_hash":"211109787713200289004537938042141295150","length":1001},"id":"CVE-2026-88357-76738901","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f","target":{"file":"example/reader_util.h"},"deprecated":false,"digest":{"line_hashes":["82851453246988689168974440282106520829","289685842288647018145892966052073791012","83836126244643903745241794440041012558","24439637271742335531267014424645442993"],"threshold":0.9},"id":"CVE-2026-88357-76cbea6c","signature_type":"Line"},{"id":"CVE-2026-88357-7dffdd29","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/8fc3b439920021a77165f8aee4f81b25bc88629e","target":{"file":"example/reader_util.h"},"deprecated":false,"digest":{"line_hashes":["82851453246988689168974440282106520829","289685842288647018145892966052073791012","83836126244643903745241794440041012558","24439637271742335531267014424645442993"],"threshold":0.9}},{"source":"https://github.com/utoni/ndpi/commit/8fc3b439920021a77165f8aee4f81b25bc88629e","target":{"function":"ndpi_print_ranking","file":"src/lib/ndpi_analyze.c"},"deprecated":false,"digest":{"function_hash":"211109787713200289004537938042141295150","length":1001},"id":"CVE-2026-88357-83390766","signature_type":"Function","signature_version":"v1"},{"target":{"file":"src/include/ndpi_typedefs.h"},"deprecated":false,"digest":{"line_hashes":["238691010401678187662239018275730067049","157379003960321107652526723133018644137","303943770297133141663227895377085089573","106659452629216698533266268766395734867"],"threshold":0.9},"id":"CVE-2026-88357-873fb007","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/8fc3b439920021a77165f8aee4f81b25bc88629e"},{"id":"CVE-2026-88357-88cba827","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e","target":{"file":"src/include/ndpi_typedefs.h"},"deprecated":false,"digest":{"line_hashes":["238691010401678187662239018275730067049","157379003960321107652526723133018644137","303943770297133141663227895377085089573","106659452629216698533266268766395734867"],"threshold":0.9}},{"deprecated":false,"digest":{"function_hash":"290877485421295977921914775857823670828","length":3397},"id":"CVE-2026-88357-89636f8d","signature_type":"Function","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594","target":{"file":"src/lib/protocols/dns.c","function":"process_answers"}},{"digest":{"line_hashes":["156476060102533669446747795553766400207","213540146702219366897232270306381035847","117293049175567953106776075729698701873","127147343712444085478154974541650754424","271405891977349242200611426138317403426","70449238329207778256071712619870828854","108296065469110464826932263037840809117","262691485673553516672681757884641532862"],"threshold":0.9},"id":"CVE-2026-88357-98cf6cbe","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/8fc3b439920021a77165f8aee4f81b25bc88629e","target":{"file":"src/lib/ndpi_analyze.c"},"deprecated":false},{"target":{"function":"ndpi_ranking_add_epoch","file":"src/lib/ndpi_analyze.c"},"deprecated":false,"digest":{"function_hash":"61183990946857988085144540760125598980","length":1979},"id":"CVE-2026-88357-a25b9cef","signature_type":"Function","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594"},{"id":"CVE-2026-88357-a7f77430","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594","target":{"file":"src/lib/protocols/mudfish.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["229397197498952383957595649782094594884","334643732289533131864665516794949321388","64217293575105245657330017544279216045","117541077612258006743551757574279981177","285156303413514186606869404558272833007","320223506882662246152965955398942647946","771278657857281861944365581750034881","153349257043394045320524732767629999883","143457236178954716102157707333297020031"]}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594","target":{"file":"src/lib/ndpi_analyze.c"},"deprecated":false,"digest":{"line_hashes":["156476060102533669446747795553766400207","213540146702219366897232270306381035847","117293049175567953106776075729698701873","127147343712444085478154974541650754424","271405891977349242200611426138317403426","70449238329207778256071712619870828854","108296065469110464826932263037840809117","262691485673553516672681757884641532862"],"threshold":0.9},"id":"CVE-2026-88357-b1c56e3b"},{"target":{"file":"src/lib/protocols/mudfish.c","function":"ndpi_search_mudfish"},"deprecated":false,"digest":{"function_hash":"307157549573808725306429880758782261909","length":1122},"id":"CVE-2026-88357-b47374c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594"},{"deprecated":false,"digest":{"line_hashes":["322556433899942276876837446187882574617","272676650778161207078389198129982681674","123159730254354200761281984699161740109","57438649125658696424667634727571082866","271862110833922775240261539119452408667","304855563457301411950430915203054624372","102624500794610404298342641410441592820"],"threshold":0.9},"id":"CVE-2026-88357-c019c1b6","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594","target":{"file":"src/lib/protocols/stun.c"}},{"source":"https://github.com/utoni/ndpi/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e","target":{"file":"src/lib/ndpi_analyze.c","function":"ndpi_ranking_add_epoch"},"deprecated":false,"digest":{"function_hash":"61183990946857988085144540760125598980","length":1979},"id":"CVE-2026-88357-c7ee53b3","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["82851453246988689168974440282106520829","289685842288647018145892966052073791012","83836126244643903745241794440041012558","24439637271742335531267014424645442993"],"threshold":0.9},"id":"CVE-2026-88357-c937638d","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e","target":{"file":"example/reader_util.h"}},{"target":{"file":"src/lib/ndpi_analyze.c","function":"ndpi_ranking_add_epoch"},"deprecated":false,"digest":{"length":1979,"function_hash":"61183990946857988085144540760125598980"},"id":"CVE-2026-88357-dab874a8","signature_type":"Function","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f"},{"id":"CVE-2026-88357-e06ea731","signature_type":"Line","signature_version":"v1","source":"https://github.com/utoni/ndpi/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f","target":{"file":"src/lib/ndpi_analyze.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["156476060102533669446747795553766400207","213540146702219366897232270306381035847","117293049175567953106776075729698701873","127147343712444085478154974541650754424","271405891977349242200611426138317403426","70449238329207778256071712619870828854","108296065469110464826932263037840809117","262691485673553516672681757884641532862"]}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88357.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}