EUVD-2026-107370
GHSA-mj78-cj39-7cv9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device inspecting SMTP traffic
-
ExploitSend crafted MIME fields over established SMTP connection
-
ExecutionTrigger unchecked parse in MIME decoder
-
ImpactSnort 3 Detection Engine restarts (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Buffer access bounds checking
|
| Exploitation Conditions | Exploitation requires that the target Cisco device actively inspect SMTP traffic with the Snort 3 engine (Cisco Open Source Snort3, Secure Firewall Threat Defense (FTD) software, or UTD Snort IPS Engine software) and that the attacker can send a crafted message with malformed MIME header fields over an already-established SMTP connection that is parsed by Snort 3. The limiting factor is this delivery path: the attacker must be positioned so malicious SMTP traffic transits the Snort 3 inspection point, and the impact is confined to an unexpected restart of the Detection Engine (availability only) with no confidentiality or integrity effect. No authentication to the Cisco device is required (PR:N), and no user interaction is needed, but the practical 'established SMTP connection' prerequisite constrains opportunistic exploitation. |
| Impact | This is a moderate-severity denial-of-service issue, not a top-tier priority, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L, base 5.8) confirms a network-reachable, low-complexity, unauthenticated flaw with no confidentiality or integrity impact and only LOW availability impact - reflecting that a successful exploit merely restarts the Snort 3 Detection Engine rather than crashing the host or enabling code execution. The scope change (S:C) is justified because the vulnerable Snort engine is a security component whose failure affects the traffic it inspects for other systems. No EPSS score, CISA KEV entry, SSVC decision, or POC was provided in the input, so there is no evidence of active exploitation or weaponization. Overall the real-world risk is bounded: the impact is a transient inspection-engine restart (potential fail-open/fail-closed inspection gap or brief traffic disruption depending on configuration), not compromise. The main caveat is that the description specifies exploitation 'through an established connection,' which adds a practical delivery prerequisite the CVSS AC:L metric does not fully capture - verify realistic reachability in your deployment. |
| Exploit ScenarioDerived | An attacker who can route SMTP traffic through a Cisco device running the Snort 3 engine (e.g., mail traversing a Secure Firewall Threat Defense sensor) opens or rides an established SMTP connection and sends a crafted message with malformed MIME header fields. The SMTP MIME decoder fails to perform error checking while parsing those fields, forcing the Snort 3 Detection Engine to unexpectedly restart and producing a denial-of-service condition. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Denial of service in Cisco Snort 3 allows unauthenticated remote attackers to restart the Snort 3 Detection Engine by sending crafted SMTP packets with malformed MIME header fields over an established connection. The defect is missing error checking during SMTP MIME header parsing (CWE-805), and successful exploitation only affects availability, forcing a restart that can briefly interrupt inspection. Affected deployments include Cisco Open Source Snort3, Secure Firewall Threat Defense (FTD) software, and UTD Snort IPS Engine software that actively inspect SMTP traffic; no public exploit has been identified at time of analysis.
RemediationAI
Patch status: Patch available per vendor advisory. Cisco's security advisory at https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-bkXjcKkt is the authoritative remediation source; obtain and apply the fixed software release it lists for Cisco Open Source Snort3, Secure Firewall Threat Defense (FTD), or UTD Snort IPS Engine software. Until the fixed release is applied, reduce exposure by disabling SMTP inspection in the Snort 3 policy or restricting SMTP traffic that reaches the inspection point to trusted senders, accepting the trade-off of lost SMTP threat detection and possible mail-flow or policy impacts; additionally, segment or rate-limit SMTP traffic at network boundaries to make it harder for an attacker to deliver crafted messages to the parser. Verify that any Snort 3 restart caused by malformed SMTP traffic is logged and monitored so repeated attempts can be investigated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Snort 3 is Cisco's open-source intrusion detection and prevention engine; its SMTP MIME decoder parses SMTP headers and MIME structures so email content can be inspected. CWE-805 (Buffer Access with Incorrect Length Value) points to the root cause: the decoder does not adequately validate or error-check MIME field lengths and values when parsing SMTP headers, so crafted packets can drive the parser into an invalid state and trigger a restart of the Detection Engine. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L indicates network-reachable, low-complexity exploitation with no privileges or user interaction, changed scope, and only low availability impact; confidentiality and integrity are unaffected. The supplied CPEs identify Cisco Open Source Snort3, Cisco Secure Firewall Threat Defense (FTD) software, and Cisco UTD Snort IPS Engine software as the affected codebases.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Network-reachable, unauthenticated, low-complexity parsing flaw (AV:N/AC:L/PR:N/UI:N); scope changed as the security engine inspects others' traffic; only a transient engine restart yields A:L with no C/I impact.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart.
This vulnerability is due to a lack of error checking when the MIME fields of the SMTP header are parsed. An attacker could exploit this vulnerability by sending crafted SMTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a denial of service (DoS) condition when the Snort 3 Detection Engine unexpectedly restarts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB