CVE-2026-88357

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88357
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88357.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-88357
Downstream
Published
2026-09-24T00:00:00Z
Modified
2026-09-26T08:10:32Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignment checks. This results in undefined behavior and can cause process termination in UBSan-instrumented builds or on strict-alignment architectures, leading to denial of service.

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88357.json"
}
References

Affected packages

Git / github.com/utoni/ndpi

Affected ranges

Type
GIT
Repo
https://github.com/utoni/ndpi
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6698f14bf6025394a537fe23f413cf79e9d13594
Fixed
694231bb43ff21f452fbc2b53fcf6cdc9a99f75f
Fixed
6ce1280c52ed52a97332c3fe58fd2b47b867ec6e
Fixed
8fc3b439920021a77165f8aee4f81b25bc88629e
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88357.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "317261641934007957187331818082608460978",
                "314383203782760101538147942172329456514",
                "168916711615451676731458660488018187556",
                "89867862496985500416721213944030544868",
                "265126449386432336967196269844749292800",
                "238691010401678187662239018275730067049",
                "157379003960321107652526723133018644137",
                "303943770297133141663227895377085089573",
                "106659452629216698533266268766395734867"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-0d6731d7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/include/ndpi_typedefs.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "42160032179911239831608265827765078743",
                "338583755732524209678601168035557957271",
                "321542332313300494904823497059233363525",
                "123372051143456563951063429732099601644",
                "81666197492059997191019334081155952827",
                "263482333039876437875848180782702213839",
                "310958892337628186104282140022377262671",
                "167089886877565100137662231015666226960"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-17e7ca5e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/protocols/blizzard.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "17816041334710858668752149242313840382",
            "length":  1782
        },
        "id":  "CVE-2026-88357-259950bb",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/protocols/blizzard.c",
            "function":  "search_blizzard_tcp"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "82851453246988689168974440282106520829",
                "289685842288647018145892966052073791012",
                "83836126244643903745241794440041012558",
                "24439637271742335531267014424645442993"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-3568e295",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "example/reader_util.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "185016895312057313366263653345899416276",
            "length":  162
        },
        "id":  "CVE-2026-88357-505884c2",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/protocols/dns.c",
            "function":  "get16"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "211109787713200289004537938042141295150",
            "length":  1001
        },
        "id":  "CVE-2026-88357-51434736",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c",
            "function":  "ndpi_print_ranking"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "156476060102533669446747795553766400207",
                "213540146702219366897232270306381035847",
                "117293049175567953106776075729698701873",
                "127147343712444085478154974541650754424",
                "271405891977349242200611426138317403426",
                "70449238329207778256071712619870828854",
                "108296065469110464826932263037840809117",
                "262691485673553516672681757884641532862"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-5420bbba",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "1735987685962774120708995386265071274",
            "length":  8083
        },
        "id":  "CVE-2026-88357-5e47c5ca",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/protocols/stun.c",
            "function":  "is_stun"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "211109787713200289004537938042141295150",
            "length":  1001
        },
        "id":  "CVE-2026-88357-5eebab27",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c",
            "function":  "ndpi_print_ranking"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "238691010401678187662239018275730067049",
                "157379003960321107652526723133018644137",
                "303943770297133141663227895377085089573",
                "106659452629216698533266268766395734867"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-61403bf9",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f",
        "target":  {
            "file":  "src/include/ndpi_typedefs.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "61183990946857988085144540760125598980",
            "length":  1979
        },
        "id":  "CVE-2026-88357-6c2c35cd",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/8fc3b439920021a77165f8aee4f81b25bc88629e",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c",
            "function":  "ndpi_ranking_add_epoch"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "96473076024061932099890413838224763713",
                "254263696223929072825593113044019317278",
                "159350119412950410548266606503959342143",
                "332682917349034201501933201549862062431",
                "109622405245285929987100908918150110632",
                "245209985858621998190987040364295939204",
                "139703793955197405056635158522442740206",
                "49781887060437207648840945805454065524",
                "30847599263301406418823241094467200122",
                "16149156684663778532629618352467197204",
                "195404444311580519271477396607881741097",
                "225061825511982711178624285251509344811"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-6d715979",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/protocols/dns.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "211109787713200289004537938042141295150",
            "length":  1001
        },
        "id":  "CVE-2026-88357-76738901",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c",
            "function":  "ndpi_print_ranking"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "82851453246988689168974440282106520829",
                "289685842288647018145892966052073791012",
                "83836126244643903745241794440041012558",
                "24439637271742335531267014424645442993"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-76cbea6c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f",
        "target":  {
            "file":  "example/reader_util.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "82851453246988689168974440282106520829",
                "289685842288647018145892966052073791012",
                "83836126244643903745241794440041012558",
                "24439637271742335531267014424645442993"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-7dffdd29",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/8fc3b439920021a77165f8aee4f81b25bc88629e",
        "target":  {
            "file":  "example/reader_util.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "211109787713200289004537938042141295150",
            "length":  1001
        },
        "id":  "CVE-2026-88357-83390766",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/8fc3b439920021a77165f8aee4f81b25bc88629e",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c",
            "function":  "ndpi_print_ranking"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "238691010401678187662239018275730067049",
                "157379003960321107652526723133018644137",
                "303943770297133141663227895377085089573",
                "106659452629216698533266268766395734867"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-873fb007",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/8fc3b439920021a77165f8aee4f81b25bc88629e",
        "target":  {
            "file":  "src/include/ndpi_typedefs.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "238691010401678187662239018275730067049",
                "157379003960321107652526723133018644137",
                "303943770297133141663227895377085089573",
                "106659452629216698533266268766395734867"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-88cba827",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e",
        "target":  {
            "file":  "src/include/ndpi_typedefs.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "290877485421295977921914775857823670828",
            "length":  3397
        },
        "id":  "CVE-2026-88357-89636f8d",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/protocols/dns.c",
            "function":  "process_answers"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "156476060102533669446747795553766400207",
                "213540146702219366897232270306381035847",
                "117293049175567953106776075729698701873",
                "127147343712444085478154974541650754424",
                "271405891977349242200611426138317403426",
                "70449238329207778256071712619870828854",
                "108296065469110464826932263037840809117",
                "262691485673553516672681757884641532862"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-98cf6cbe",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/8fc3b439920021a77165f8aee4f81b25bc88629e",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "61183990946857988085144540760125598980",
            "length":  1979
        },
        "id":  "CVE-2026-88357-a25b9cef",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c",
            "function":  "ndpi_ranking_add_epoch"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "229397197498952383957595649782094594884",
                "334643732289533131864665516794949321388",
                "64217293575105245657330017544279216045",
                "117541077612258006743551757574279981177",
                "285156303413514186606869404558272833007",
                "320223506882662246152965955398942647946",
                "771278657857281861944365581750034881",
                "153349257043394045320524732767629999883",
                "143457236178954716102157707333297020031"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-a7f77430",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/protocols/mudfish.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "156476060102533669446747795553766400207",
                "213540146702219366897232270306381035847",
                "117293049175567953106776075729698701873",
                "127147343712444085478154974541650754424",
                "271405891977349242200611426138317403426",
                "70449238329207778256071712619870828854",
                "108296065469110464826932263037840809117",
                "262691485673553516672681757884641532862"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-b1c56e3b",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "307157549573808725306429880758782261909",
            "length":  1122
        },
        "id":  "CVE-2026-88357-b47374c9",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/protocols/mudfish.c",
            "function":  "ndpi_search_mudfish"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "322556433899942276876837446187882574617",
                "272676650778161207078389198129982681674",
                "123159730254354200761281984699161740109",
                "57438649125658696424667634727571082866",
                "271862110833922775240261539119452408667",
                "304855563457301411950430915203054624372",
                "102624500794610404298342641410441592820"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-c019c1b6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6698f14bf6025394a537fe23f413cf79e9d13594",
        "target":  {
            "file":  "src/lib/protocols/stun.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "61183990946857988085144540760125598980",
            "length":  1979
        },
        "id":  "CVE-2026-88357-c7ee53b3",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c",
            "function":  "ndpi_ranking_add_epoch"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "82851453246988689168974440282106520829",
                "289685842288647018145892966052073791012",
                "83836126244643903745241794440041012558",
                "24439637271742335531267014424645442993"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-c937638d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/6ce1280c52ed52a97332c3fe58fd2b47b867ec6e",
        "target":  {
            "file":  "example/reader_util.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "61183990946857988085144540760125598980",
            "length":  1979
        },
        "id":  "CVE-2026-88357-dab874a8",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c",
            "function":  "ndpi_ranking_add_epoch"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "156476060102533669446747795553766400207",
                "213540146702219366897232270306381035847",
                "117293049175567953106776075729698701873",
                "127147343712444085478154974541650754424",
                "271405891977349242200611426138317403426",
                "70449238329207778256071712619870828854",
                "108296065469110464826932263037840809117",
                "262691485673553516672681757884641532862"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88357-e06ea731",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/utoni/ndpi/commit/694231bb43ff21f452fbc2b53fcf6cdc9a99f75f",
        "target":  {
            "file":  "src/lib/ndpi_analyze.c"
        }
    }
]
vanir_signatures_modified 
"2026-09-26T08:10:32Z"