CVE-2026-76489: Multiple Cisco Products Snort 3 Generic File Processing Memory Exhaustion Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory. An attacker could exploit this vulnerability by sending a large number of files to be processed. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a DoS condition.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what access is required?
An unauthenticated remote attacker can exploit it. The attacker needs to be able to send a large number of files that Snort 3 will process.
What is the operational impact of a successful attack?
A successful attack can cause the Snort 3 Detection Engine to restart unexpectedly. Packet inspection is interrupted while the engine restarts, creating a denial-of-service condition.
What component is affected by the vulnerability?
The issue affects Snort 3's generic file processing and memory management implementation. Incomplete error checking during file processing can leave memory unreleased.