CVE-2026-121944: sngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLV
sngrep through 1.9.0 contains an infinite loop vulnerability in capturepacketreasmip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, making the capture thread spin at full CPU and stop processing packets.
Event History
Frequently Asked Questions
Who is exposed to this denial-of-service issue?
Systems using sngrep through 1.9.0 to process PCAP input with the NFLOG link type are exposed. The issue is triggered when that input contains a non-payload NFLOG TLV whose length is less than 4.
What does an attacker need to do to trigger the issue?
An attacker needs to supply a crafted NFLOG PCAP file and have it processed by sngrep. No privileges are required by the vulnerability vector, but user interaction is required to open or otherwise process the crafted capture file.
How can I recognize exploitation or a vulnerable processing event?
When processing the crafted capture, the sngrep capture thread spins at full CPU usage and stops processing packets. The affected input is an NFLOG PCAP containing a non-payload TLV with a length below 4.