CVE-2026-76445: Multiple Cisco Products Snort 3 Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The attacker can be unauthenticated and remote. They need to be able to send traffic to the Snort 3 Detection Engine on an affected device.
What traffic is required to trigger the condition?
Exploitation requires a crafted, fragmented UDP datagram containing GTP extension headers. The malformed traffic must be processed by the GTP codec in the Snort 3 Detection Engine.
What operational signs could indicate exploitation?
A successful attack can cause the detection engine to enter an infinite loop and unexpectedly restart. This results in a denial-of-service condition affecting the detection engine.