Skip to content
Fencer Vulns
critical 9.8

CVE-2020-11939 json

In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overf…

published 2020-04-23 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-4276

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.3%
EPSS 3.3% chance of exploitation in 30 days, percentile 88%
public exploits
0
none known

Summary

In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Due to the granular nature of the overflow primitive and the ability to control both the contents and layout of the nDPI library's heap memory through remote input, this vulnerability may be abused to achieve full Remote Code Execution against any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis.

Patch / fix

  • ndpi Debian 14, Debian 13, Debian 12 3.4-1

debian advisories DEBIAN-CVE-2020-11939

Exploit prediction

3.30% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • securitylab.github.com https://securitylab.github.com/advisories/GHSL-2020-051_052-ntop-ndpi referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.