Cisco Snort 3
CVE-2025-20360
MEDIUM
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRoute HTTP traffic through Snort 3 device
-
ExploitSend crafted malformed MIME headers
-
ExecutionTrigger HTTP decoder error-check gap
-
ImpactSnort 3 Detection Engine restarts (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer access bounds checking
|
| Exploitation Conditions | Exploitation requires that the target Cisco device be running the Snort 3 Detection Engine and be actively inspecting HTTP traffic that the attacker can traverse, and the attacker must send the crafted MIME-malformed packets over an already-established connection through that device. No authentication or user interaction is needed (PR:N/UI:N). Limiting factors: the attacker must be able to get HTTP traffic parsed by the Snort 3 engine (i.e., the device is deployed inline/in an inspection path for reachable traffic), and devices running the Snort 2 engine or not performing HTTP inspection are not in scope; impact is confined to a temporary availability disruption from the engine restart. |
| Impact | This is a moderate-severity availability-only flaw, not a top priority despite its network-facing nature. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes an unauthenticated, low-complexity remote trigger, and the scope change (S:C) reflects that a Snort 3 engine restart degrades inspection/throughput for the traffic it protects rather than just the host itself - but impact is limited to availability (C:N/I:N) and only A:L, consistent with a transient detection-engine restart rather than a full outage. The EPSS score of 0.38% (31st percentile) indicates low modeled exploitation probability, and there is no CISA KEV listing and no public exploit identified, so all exploitation signals point low. The one notable conflict is in the input metadata: the 'Information Disclosure' tag contradicts the CVSS vector (C:N, i.e. no confidentiality impact) and the description, which clearly describes a denial-of-service restart - this appears to be a mislabeled tag and should not drive risk decisions. Net: a genuine but low-urgency DoS best handled via normal patch cycles, prioritized higher only for Cisco devices exposed to untrusted HTTP traffic in inline/inspection mode. |
| Exploit ScenarioDerived | An unauthenticated remote attacker who can route HTTP traffic through a Cisco device running the Snort 3 engine sends crafted HTTP packets with malformed MIME header fields over an already-established connection. Incomplete error checking in the HTTP decoder causes the Snort 3 Detection Engine to unexpectedly restart, briefly disrupting traffic inspection. No public exploit code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Denial of service in Cisco Snort 3 allows unauthenticated remote attackers to force the detection engine to restart by sending crafted HTTP packets whose MIME header fields are parsed by the Snort 3 HTTP decoder over an already-established connection. Affected deployments are Cisco products running Snort 3 and inspecting attacker-reachable HTTP traffic; Snort 2 sensors and devices not performing HTTP inspection are outside the assessed scope. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS is low at 0.38% (31st percentile), with impact limited to a temporary availability disruption.
RemediationAI
Apply the fixed software release specified for each affected Cisco platform in Cisco advisory cisco-sa-snort3-mime-vulns-tTL8PgVH at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH; the provided input does not include an exact fix version, so the advisory is the authoritative source for patched releases. If immediate upgrade is not possible, reduce exposure by restricting which attacker-reachable HTTP traffic is steered through Snort 3 HTTP inspection with ACLs or network segmentation, at the trade-off of leaving uninspected paths and reducing detection coverage; alternatively, temporarily disable Snort 3 HTTP inspection or fall back to Snort 2 where the platform supports it, accepting reduced or alternate detection fidelity. For availability-sensitive inline deployments, add redundant sensors or failover so an engine restart does not break traffic inspection, recognizing that this mitigates downtime but not the underlying parser flaw.
Affected ProductsAI
Multiple Cisco products that run the Snort 3 Detection Engine and perform HTTP inspection are affected, as listed in Cisco advisory cisco-sa-snort3-mime-vulns-tTL8PgVH at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH. The provided data does not include exact platform model numbers, affected version ranges, or CPE strings, so those specifics must be confirmed from the advisory; devices running Snort 2 or not inspecting HTTP traffic are not in the assessed scope. No separate NVD CPE list was supplied.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Cisco Snort 3 is the next-generation intrusion detection and prevention engine used in multiple Cisco security platforms. Its HTTP decoder parses request and response headers, including MIME-related fields, before detection logic runs. The flaw is rooted in CWE-805, Buffer Access with Incorrect Length Value, and per Cisco involves incomplete error checking when MIME fields are parsed; malformed HTTP header content can drive the decoder into an error path that restarts the Snort 3 Detection Engine. The CVSS vector is network-reachable with low complexity, no privileges or user interaction, scope changed, and availability-low impact with no confidentiality or integrity impact; the supplied Information Disclosure tag is not consistent with the C:N/I:N assessment and is not treated as an impact here. Exploitation requires the device to be running Snort 3 and inspecting HTTP traffic the attacker can traverse, delivered over an established connection; the result is a temporary DoS from engine restart rather than code execution or data exposure.
Know when Snort gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Unauthenticated remote crafted packets (AV:N/AC:L/PR:N/UI:N); scope changes because the engine protects other traffic (S:C); only transient availability impact (A:L, C/I:N).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.
This vulnerability is due to a lack of complete error checking when the MIME fields of the HTTP header are parsed. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct
A buffer under-read in the Snort 3 HTTP decoder lets unauthenticated, remote attackers crash the detection engine or exp
Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic tha
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticate
Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attac
Cisco Sourcefire Snort 3.0 before build 233 mishandles Ether Type Validation. Rated high severity (CVSS 7.5), this vulne
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticate
Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that
Cisco Snort 3 Detection Engine can be remotely restarted by an unauthenticated attacker through crafted HTTP packets exp
Unauthenticated remote attackers can crash the Snort 3 Detection Engine by sending crafted HTTP packets with malformed M
Snort 3 Detection Engine crashes when processing malformed VBA data due to improper decompression error handling, allowi
GitHub PoC
Exploit-DB