Snort
CVE-2026-20054
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.
This vulnerability is due to improper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to enter an infinite loop, causing a DoS condition.
AnalysisAI
Improper error checking in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to trigger an infinite loop by sending specially crafted VBA data, causing a denial of service condition. The vulnerability affects multiple Cisco products and requires no user interaction or authentication to exploit. No patch is currently available.
Technical ContextAI
Classified as CWE-835 (Loop with Unreachable Exit Condition (Infinite Loop)). Affects Snort 3 VBA feature. Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.
This vulnerability is due to improper error checking when decompressing VBA data. An attacker could exploit this vulnerability by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to enter an
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct
Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic tha
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticate
Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attac
Cisco Sourcefire Snort 3.0 before build 233 mishandles Ether Type Validation. Rated high severity (CVSS 7.5), this vulne
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticate
Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that
Cisco Snort 3 Detection Engine can be remotely restarted by an unauthenticated attacker through crafted HTTP packets exp
Unauthenticated remote attackers can crash the Snort 3 Detection Engine by sending crafted HTTP packets with malformed M
Snort 3 Detection Engine crashes when processing malformed VBA data due to improper decompression error handling, allowi
Denial of service in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to crash the dete
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today