EUVD-2026-107371
GHSA-pqhw-xr48-3362
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Snort 3 inspection path
-
DeliveryCraft malformed UDP NetFlow packet
-
ExploitSend single packet over established connection
-
ExecutionTrigger incomplete error check in parser
-
PersistDetection Engine restarts
-
ImpactPacket inspection interrupted (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target run the Snort 3 Detection Engine with NetFlow detection active and that the attacker's crafted UDP NetFlow packet actually reach and be parsed by Snort 3 over an established connection - i.e., the sensor must be positioned to inspect NetFlow (UDP) traffic in its path. The practical limiting factor is this traffic-path reachability and NetFlow inspection being in use; there is no authentication or user-interaction barrier (PR:N/UI:N), and default-affected builds of Cisco Open Source Snort3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software are susceptible. Impact is limited to a transient availability interruption (engine restart), with no confidentiality or integrity effect. |
| Impact | This is a genuine but moderate-priority issue, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, base 5.8) describes a network-reachable, low-complexity, unauthenticated attack with no confidentiality or integrity impact and only LOW availability impact - consistent with the described DoS (Snort 3 Detection Engine restart). CWE-835 (uncontrolled loop / incomplete exit condition) aligns with the 'incomplete error checking' parsing flaw. The scope change (S:C) is appropriate: the vulnerable component (Snort engine) differs from the impacted authority (the firewall/IPS inspection path protecting the broader network). No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (network DoS, no code execution), so there is no high-CVSS-but-low-risk contradiction to flag; rather this is a correctly-scored medium-severity availability bug. Real-world priority rises for organizations whose Snort 3 deployments actually parse NetFlow UDP traffic, since the impact is loss of packet inspection - a security-blinding condition - rather than mere service crash. |
| Exploit ScenarioDerived | An attacker who can route traffic through a vulnerable Cisco Snort 3 sensor sends a single crafted UDP NetFlow packet over an already-established connection; Snort's NetFlow parser hits the incomplete error-checking path and the Detection Engine restarts, briefly suspending packet inspection. Because the attack is unauthenticated, network-based, and low-complexity (AV:N/AC:L/PR:N/UI:N), it requires only reachability to the inspection path; no public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in Cisco Snort 3 allows an unauthenticated, remote attacker to restart the detection engine by sending a single crafted UDP NetFlow packet, interrupting packet inspection. The issue affects Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software when NetFlow detection is active and the crafted packet reaches the parser; Cisco rates it CVSS 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/A:L). This is a moderate-priority availability issue, with no public exploit identified at time of analysis, and exploitation depends on NetFlow traffic being in the sensor's inspection path.
RemediationAI
No exact fixed version is specified in the provided data, so patch status is not independently confirmed here; consult the Cisco Security Advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-misc-dos-6mB22qAK for the fixed software releases and upgrade instructions, and treat the vendor advisory as the authoritative source for affected and remediated builds. Because the flaw is reached through NetFlow parsing, a practical workaround is to disable NetFlow detection in Snort 3 policies where flow telemetry inspection is not required; this removes the attack surface but reduces NetFlow visibility. Alternatively, restrict UDP NetFlow traffic to trusted exporters and the sensor with ACLs or network segmentation and rate-limit NetFlow packets; overly tight rules can break legitimate telemetry. Monitor for Snort 3 detection engine restarts and unexpected inspection gaps, and apply the Cisco-provided fixed release as identified in the advisory.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Snort 3 is Cisco's open-source intrusion detection and prevention engine, and its NetFlow detection component parses UDP NetFlow records to support flow-based inspection. The supplied CPE data lists Cisco Open Source Snort3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD Snort IPS Engine Software, with wildcard versions indicating that all versions in those product families should be treated as potentially affected unless the Cisco advisory identifies fixed releases. CWE-835 (Loop with Unreachable Exit Condition) points to incomplete error checking when Snort 3 parses UDP NetFlow packets: a malformed flow record can drive the parser into a state from which it cannot exit cleanly, forcing the detection engine to restart. The CVSS vector's PR:N/UI:N values confirm that no authentication or user interaction is required once the reachability preconditions are met, and the scope-changed availability-only impact (C:N/I:N/A:L) is consistent with a transient inspection outage rather than data compromise or persistent modification.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Single unauthenticated network packet triggers the parser (AV:N/AC:L/PR:N/UI:N); engine restart affects the broader inspection authority (S:C) with only availability impact (A:L).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
Multiple Cisco products are affected by a vulnerability in the Snort 3 NetFlow Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.
This vulnerability is due to incomplete error checking when Snort 3 parses UDP Netflow Protocol packets. An attacker could exploit this vulnerability by sending a single crafted Netflow packet through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a DoS condition.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB