CVE-2026-76445
Multiple Cisco Products Snort 3 Denial of Service Vulnerability
Description
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.
Weakness: CWE-835
Affected products
| Vendor | Product | Category | Matched by |
|---|---|---|---|
| Cisco | Cisco Firepower Threat Defense (FTD) Check your version | Firewall / NGFW | cna-assigner |
| Cisco | Cisco UTD SNORT IPS Engine | Threat Detection & Sandbox | cna-assigner |
Vendor-reported products (3)
- Cisco · Cisco Open Source Snort3
- Cisco · Cisco Secure Firewall Threat Defense (FTD) Software
- Cisco · Cisco UTD SNORT IPS Engine Software
Vendor advisory
cisco-sa-snort3-gtpcodec-dos-Rmecfepz
Multiple Cisco Products Snort 3 Denial of Service Vulnerability
Cisco’s rating: Medium (advisory CVSS 5.3) · Published Oct 21, 2026
Bug ID: CSCwu17795
The vendor’s rating applies to the whole advisory and can differ from this CVE’s own CVSS severity. Where this comes from