CVE-2026-76445
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine related to handling GTP extension headers in the codec. An unauthenticated remote attacker can send a crafted, fragmented UDP datagram, causing an infinite loop and a denial of service condition.
Risk Assessment
An attacker can trigger an infinite loop in the detection engine, causing a denial of service and interrupting traffic inspection. This may weaken network protection.
Recommendation
Apply Cisco updates containing the Snort 3 fix. Monitor detection engine health and consider additional network protections.
Other vulnerabilities in Snort 3 Detection Engine
See all- CVE-2026-20221Medium
Multiple Cisco products are affected by a vulnerability in the GRE tunnel decapsulation feature of the Snort 3 Detection Engine. An unauthenticated remote attacker can send a crafted GRE payload, causing an unexpected restart of the engine and leading to a bypass or denial of service condition.
- CVE-2026-20065Medium
A vulnerability in the Snort 3 Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the engine to restart, interrupting packet inspection. The issue is due to an error in the binder module initialization logic. Exploitation involves sending certain packets through an established connection.
Original NVD description (English source)
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS