{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"ndpi","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":[],"id":"tcs_01M5NW5DW7R6NC8M28RVGYS4FC","modified_at":"2026-09-26T19:00:07.637165140Z","published_at":"2026-09-24T16:17:12.957Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2026-88357","https://security-tracker.debian.org/tracker/CVE-2026-88357"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2026-88357#Debian:14/ndpi","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-88357"}],"summary":"nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_"}