← Back to Security Research Portal (ccsimplyspolit.github.io)

GHSA-4x7j-8w5q-5f7w: DCE/RPC Fragment Length Detection Bypass & DHCP Option Offset Clamping in ntop/nDPI

[PUBLISHED BY VENDOR • FIXED IN COMMIT ff44ed2]
Privately reported to ntop/nDPI via GitHub Private Vulnerability Reporting (GHSA-4x7j-8w5q-5f7w) covering src/lib/protocols/dcerpc.c and src/lib/protocols/dhcp.c.
Confirmed, fixed in commit ff44ed2, and officially published by nDPI maintainer Ivan Nardi (@IvanNardi) on 2026-10-30T17:39:13Z with accepted reporter credit to @ccsimplyspolit.

0x00 // GitHub Security Advisory & Remediation Metadata

{
  "ghsa_id": "GHSA-4x7j-8w5q-5f7w",
  "repository": "ntop/nDPI",
  "html_url": "https://github.com/ntop/nDPI/security/advisories/GHSA-4x7j-8w5q-5f7w",
  "fix_commit": "https://github.com/ntop/nDPI/commit/ff44ed2",
  "state": "published",
  "published_at": "2026-10-30T17:39:13Z",
  "severity": "moderate",
  "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "credits": [
    {
      "login": "ccsimplyspolit",
      "type": "reporter",
      "state": "accepted"
    }
  ],
  "cwe_ids": [
    "CWE-670"
  ]
}