Critical
Security advisory
In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-15472
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:34 UTC · Revision 1
Source evidence
In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short.
osv:CVE-2020-15472
Complete source record
{
"id": "8671513c5b119068034b0ee3b8a7957fd0e7324557bdf20b531e943bf4a18a30",
"url": "https://osv.dev/vulnerability/CVE-2020-15472",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-15472",
"summary": "In nDPI through 3.2, the H.323 dissector is vulnerable to a heap-based buffer over-read in ndpi_search_h323 in lib/protocols/h323.c, as demonstrated by a payload packet length that is too short.",
"evidence": "osv:CVE-2020-15472",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2020-15472",
"aliases": [
"CVE-2020-15472"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ntop/ndpi",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "a50169a7b3ec36c8d789191b014715126e820698"
},
{
"fixed": "b7e666e465f138ae48ab81976726e67deed12701"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ntop:ndpi:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "3.2"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "b7e666e465f138ae48ab81976726e67deed12701"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"3.2",
"1.8",
"1.7",
"1.6"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15472.json",
"vanir_signatures": [
{
"id": "CVE-2020-15472-34b066df",
"digest": {
"threshold": 0.9,
"line_hashes": [
"37158175496369557638661188348822373976",
"272624026154926481789464888923245734527",
"128483779748111000959621208148968385399",
"191203462040903637991255525166519043278",
"202137246577764407674332606051881522823",
"254581157989444017823825208114608967594",
"220552098850189103773486000282418709339",
"165523891977900981464278864081148233894",
"288065428000065310550098815522435843083",
"148286308794082704992720175692448102013",
"242158858712497459091146561446991098121",
"109788843581893408060902643379445504426",
"78347523760979884149620970830269976740",
"233305530776956303714549047494037759136",
"191898092074880987703702359714668383457",
"61243521551237482942836149853970086605",
"218822097484724381970675483307378815469",
"319047683415771416144204377688333169592",
"6050888054976502034085867643330302894",
"176698984432968540960594340912258082203",
"216811963159498958830359283333183499404",
"137864543043595842919580941327615706978",
"191320365427541717139521414971936490443",
"269697712918796504699661200759818370187",
"322999005938936772240457139788296425190",
"180711454304228101903343420551425003852",
"264226937030061930829593809046614683063",
"309470068309191534056358958172111713075",
"144449224514945957962137010936604765161",
"45964088552453602791853689467469516960",
"84815553310013667135339121934126060130",
"190513061752796812475233563543719664773",
"39372483252266719667520672835494869807",
"246317550475750345496691228926941204322",
"292467771262168747562200280333241625359",
"96532551231204530540335610046191245485",
"104234233993223039017107184641776461048",
"190513061752796812475233563543719664773",
"39372483252266719667520672835494869807",
"203714922098940276229728414483944633085",
"325463742767767808010533993873195329843",
"87218094603477226179990258826451260922",
"124322142682969937251086067914070324991",
"6796867668290565658714049661429201073",
"137864543043595842919580941327615706978",
"293949540968280903538352693917672011553",
"108587633537507210242609878158511307392",
"262905219823433313025615255739858019406",
"202601793893477208560748496062216300356"
]
},
"source": "https://github.com/ntop/ndpi/commit/b7e666e465f138ae48ab81976726e67deed12701",
"target": {
"file": "src/lib/protocols/h323.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15472-4adda645",
"digest": {
"length": 12756,
"function_hash": "297176701936531315293082439302767489781"
},
"source": "https://github.com/ntop/ndpi/commit/b7e666e465f138ae48ab81976726e67deed12701",
"target": {
"file": "example/ndpiReader.c",
"function": "printFlow"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2020-15472-610d54ee",
"digest": {
"threshold": 0.9,
"line_hashes": [
"32432617805752391356402397108210527075",
"49863619554363700977400378494479937552",
"236987109859104909434797321262381738744",
"45511070358067980906116535964497872817",
"191526781884219010682963255839179645637",
"120474216325503234291030394300257413031",
"222229711533603120877018718470369066978",
"190616763307957142858227493423005315430",
"112595345085334078359538712828315552581"
]
},
"source": "https://github.com/ntop/ndpi/commit/b7e666e465f138ae48ab81976726e67deed12701",
"target": {
"file": "example/ndpiReader.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2020-15472-a9da8f02",
"digest": {
"length": 2181,
"function_hash": "216257714192309902481608048956996799368"
},
"source": "https://github.com/ntop/ndpi/commit/b7e666e465f138ae48ab81976726e67deed12701",
"target": {
"file": "src/lib/protocols/h323.c",
"function": "ndpi_search_h323"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:52:29Z"
}
}
],
"modified": "2026-10-20T13:52:29.485581268Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2022/08/msg00016.html",
"https://github.com/ntop/nDPI/commit/b7e666e465f138ae48ab81976726e67deed12701"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "10.0"
},
{
"last_affected": "10.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2020-15472",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388322,
"published_at": "2020-07-01T11:15:11.117+00:00"
}