Snort
CVE-2026-20058
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Primary rating from Vendor (cisco) · only source for this CVE.
CVSS VectorVendor: cisco
Lifecycle Timeline
2DescriptionCVE.org
Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.
These vulnerabilities are due to improper error checking when decompressing VBA data. An attacker could exploit these vulnerabilities by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpectedly restart, causing a DoS condition.
AnalysisAI
Snort 3 Detection Engine crashes when processing malformed VBA data due to improper decompression error handling, allowing unauthenticated remote attackers to trigger denial-of-service conditions across multiple Cisco products. An attacker can exploit this vulnerability by sending crafted VBA payloads to cause unexpected engine restarts without requiring authentication or user interaction. No patch is currently available for this medium-severity flaw.
Technical ContextAI
Multiple Cisco products are affected by vulnerabilities in the Snort 3 VBA feature that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to crash.
These vulnerabilities are due to improper error checking when decompressing VBA data. An attacker could exploit these vulnerabilities by sending crafted VBA data to the Snort 3 Detection Engine on the targeted device. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to unexpect
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Untrusted search path vulnerability in Snort 2.9.7.0-WIN32 allows remote attackers to execute arbitrary code and conduct
Multiple Cisco products are affected by a vulnerability in the rate filtering feature of the Snort detection engine that
Multiple Cisco products are affected by a vulnerability in the way the Snort detection engine processes ICMP traffic tha
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticate
Multiple Cisco products are affected by a vulnerability in Snort rules that could allow an unauthenticated, remote attac
Cisco Sourcefire Snort 3.0 before build 233 mishandles Ether Type Validation. Rated high severity (CVSS 7.5), this vulne
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticate
Multiple Cisco products are affected by a vulnerability in the Snort Intrusion Prevention System (IPS) rule engine that
Cisco Snort 3 Detection Engine can be remotely restarted by an unauthenticated attacker through crafted HTTP packets exp
Unauthenticated remote attackers can crash the Snort 3 Detection Engine by sending crafted HTTP packets with malformed M
Denial of service in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to crash the dete
Improper error checking in Cisco Snort 3's VBA decompression feature allows unauthenticated remote attackers to trigger
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today