EUVD-2026-107352
GHSA-4m4m-399q-8257
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRoute file-bearing traffic through inspecting device
-
DeliverySend large volume of files for processing
-
ExploitTrigger incomplete error checking in file handler
-
ExecutionLeak unreleased memory until exhaustion
-
ImpactDetection Engine restarts, inspection interrupted
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource cleanup, leak prevention
|
| Exploitation Conditions | Exploitation requires that the affected Snort 3 Detection Engine or Cisco Secure Firewall Threat Defense device be actively inspecting a network path over which the attacker can send files, and that file processing (file policy/file inspection) be engaged so the vulnerable code path is reached. The attacker must be able to deliver a large number of files to be processed to accumulate leaked memory, implying sustained traffic rather than a single packet. Limiting factors: the device must sit in the traffic path and have file inspection active for the attacker's flows; impact is bounded to a temporary engine restart (A:L) with no confidentiality or integrity effect; and no authentication or user interaction is needed (PR:N/UI:N), which raises reachability. |
| Impact | This is a moderate-priority availability issue, not a critical one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, base 5.8) describes a network-reachable, low-complexity, unauthenticated condition with no confidentiality or integrity impact and only LOW availability impact; the elevated base score relative to a simple DoS is driven entirely by the scope change (S:C), reflecting that the Snort 3 Detection Engine protects other systems whose packet inspection lapses during the restart. No EPSS score, SSVC decision, or POC indicator was supplied in the input, and the vulnerability is NOT listed in CISA KEV, so exploitation probability signals are absent rather than low - this gap should be noted, not read as 'safe.' The impact ceiling is bounded: a restart of the detection engine causes a temporary interruption of inspection, not code execution or data exposure, and Cisco-reported DoS conditions in Snort/FTD have historically not seen mass exploitation. Net: worth patching on a normal cadence, but it does not warrant emergency response. One caveat to verify - depending on failure-open vs. failure-closed configuration, the interruption of inspection could either drop traffic (self-DoS) or allow traffic to pass uninspected during the restart window; the input does not specify which, and this materially changes the real-world consequence. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends a large volume of files through a network path inspected by an affected Snort 3 / Cisco Secure Firewall Threat Defense device. Incomplete error checking during file processing leaks unreleased memory until the Detection Engine exhausts resources and restarts, interrupting packet inspection. No public exploit code was identified in the provided data, and the attack requires only the ability to route enough file-bearing traffic through the inspecting device. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Memory management flaws in Cisco Snort 3's file-processing path allow remote, unauthenticated attackers to exhaust memory and force unexpected Detection Engine restarts, interrupting packet inspection on affected open-source Snort 3 and Cisco Secure Firewall Threat Defense deployments. The issue is rated CVSS 5.8 (moderate) with a scope change and availability-only impact; no public exploit was identified at time of analysis, and Cisco has published an advisory. Sustained delivery of files to an inspection point with file policy enabled is required, so exposure is greatest on inline sensors actively inspecting untrusted traffic.
RemediationAI
Apply the Snort 3 or Cisco Secure Firewall Threat Defense software release containing the memory-management fix as identified in Cisco Security Advisory cisco-sa-snort3-misc-dos-6mB22qAK; the provided data does not include an exact fixed version, so confirm the target release in the advisory before upgrading. If immediate upgrade is not possible, reduce exposure by narrowing file inspection policies so the vulnerable file-processing path is invoked only for necessary traffic, and rate-limit or cap file submissions from untrusted networks, accepting the trade-off of reduced file and malware detection coverage. Because exploitation requires sustained traffic through an inline inspection point, monitor Detection Engine restarts and memory pressure on FTD and Snort 3 sensors, and use redundancy or appropriate fail-open/fail-closed design to preserve availability during unexpected restarts. Validate that any policy change still meets security requirements. Patch availability is not confirmed from the provided data beyond the Cisco advisory reference.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-401, missing release of memory after effective lifetime: Snort 3 performs incomplete error checking while processing files, leaving allocated memory unreleased. Repeated file processing accumulates the leak until the Detection Engine exhausts memory and restarts, interrupting packet inspection. The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L vector matches the advisory: network reachable, no privileges or user interaction, scope changed because the restart affects the inspection subsystem, and availability impact is limited with no confidentiality or integrity effect. CPE data maps the issue to Cisco open-source Snort 3 (cisco:cisco_open_source_snort3) and Cisco Secure Firewall Threat Defense software (cisco:cisco_secure_firewall_threat_defense_(ftd)_software), with wildcard version fields; the Cisco advisory is authoritative for exact affected and fixed releases. The attacker does not need a single crafted packet but must deliver a large number of files to a path where file inspection is engaged, making sustained traffic a practical prerequisite rather than a one-shot trigger.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Remote unauthenticated file submission (AV:N/AC:L/PR:N/UI:N); engine restart interrupts inspection for protected systems (S:C) with only low, temporary availability loss (A:L).
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.
This vulnerability is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory. An attacker could exploit this vulnerability by sending a large number of files to be processed. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a DoS condition.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB