Cisco Snort 3
CVE-2025-20359
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Remote unauthenticated crafted HTTP parsed by the sensor gives AV:N/AC:L/PR:N/UI:N; under-read yields memory disclosure (C:H) and engine crash (A:H) with no integrity impact (I:N).
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the disclosure of possible sensitive data or cause the Snort 3 Detection Engine to crash.
This vulnerability is due to an error in the logic of buffer handling when the MIME fields of the HTTP header are parsed. This can result in a buffer under-read. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to induce one of two possible outcomes: the unexpected restarting of the Snort 3 Detection Engine, which could cause a denial of service (DoS) condition, or information disclosure of sensitive information in the Snort 3 data stream. Due to the under-read condition, it is possible that sensitive information that is not valid connection data could be returned.
AnalysisAI
A buffer under-read in the Snort 3 HTTP decoder lets unauthenticated, remote attackers crash the detection engine or expose adjacent memory by sending crafted HTTP packets containing malformed MIME header fields. Any deployment where attacker-controlled HTTP traffic is inspected by Snort 3 is exposed - including standalone Snort 3 and Cisco intrusion prevention deployments such as Firepower/FTD that run the Snort 3 engine - and the flaw carries a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) for high confidentiality and availability impact. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS is low at 0.42% (36th percentile).
Technical ContextAI
The root cause is CWE-127 (Buffer Under-read) in Snort 3's HTTP Decoder, specifically in the logic that handles buffer boundaries while parsing the MIME fields of HTTP headers. When the decoder miscomputes an offset during MIME parsing, it can read before the start of the intended buffer, which either produces out-of-bounds data returned from the Snort 3 data stream (information disclosure of memory that is not valid connection data) or destabilizes the detection engine and forces an unexpected restart (denial of service). The CPE entry cpe:2.3:a:cisco:snort:*:*:*:*:*:*:*:* uses a wildcard version, indicating that the CPE feed does not pin a specific affected release range, so the precise vulnerable Snort 3 builds must be confirmed against the Cisco advisory. The CVSS vector reflects a fully remote, low-complexity, unauthenticated attack with no user interaction (PR:N/UI:N) that succeeds only when crafted packets traverse an established connection actively parsed by an affected Snort 3 sensor; impact is bounded to engine crash or adjacent-memory disclosure rather than code execution or host compromise.
RemediationAI
No vendor-released patch version is identified in the provided data; administrators should consult the Cisco Security Advisory (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH) for the fixed Snort 3 software release and upgrade the sensor or the Firepower/FTD engine accordingly, since applying the patched Snort 3 build is the only action that fully closes the under-read. Because Snort 3 is an inline detection component rather than an application endpoint, effective compensating controls are limited and all carry detection trade-offs: disabling or bypassing the HTTP decoder/preprocessor stops parsing of the vulnerable MIME fields but eliminates HTTP inspection and therefore blinds the sensor to HTTP-borne threats; routing or ACL-filtering HTTP traffic so it no longer traverses the affected sensor avoids the trigger but equally removes HTTP visibility and protection; and relying on automatic engine restart supervision only reduces the availability impact of a crash without mitigating the potential information disclosure of adjacent memory. Until a fixed build is deployed, organizations requiring continuous HTTP detection should weigh the loss of HTTP inspection against the low observed exploitation signal (EPSS 0.42%, no public exploit or KEV entry) and prioritize upgrading sensors that face untrusted HTTP traffic.
Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct
Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic tha
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticate
Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attac
Cisco Sourcefire Snort 3.0 before build 233 mishandles Ether Type Validation. Rated high severity (CVSS 7.5), this vulne
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticate
Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that
Cisco Snort 3 Detection Engine can be remotely restarted by an unauthenticated attacker through crafted HTTP packets exp
Unauthenticated remote attackers can crash the Snort 3 Detection Engine by sending crafted HTTP packets with malformed M
Snort 3 Detection Engine crashes when processing malformed VBA data due to improper decompression error handling, allowi
Denial of service in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to crash the dete
Same weakness CWE-127 – Buffer Under-read
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today