EUVD-2026-107385
GHSA-5cgp-9338-jh6r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach device inspecting GTP traffic
-
DeliveryCraft fragmented UDP datagram with GTP extension headers
-
ExploitSend to Snort 3 Detection Engine
-
ExecutionFlawed codec logic enters infinite loop
-
ImpactDetection engine restarts (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Loop termination conditions
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that an affected device (Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) software, or Cisco UTD Snort IPS Engine software) be actively inspecting network traffic that includes GPRS Tunneling Protocol (GTP) packets - the flaw lives specifically in the Snort 3 codec that processes GTP extension headers. The attacker must be able to deliver a crafted, fragmented UDP datagram carrying those GTP extension headers to the detection engine's inspection path. No authentication, privileges, or user interaction are needed (PR:N/UI:N), but the practical limiting factor is deployment-specific: environments that do not route or inspect GTP traffic (common outside mobile-core/telecom or specific appliance configurations) are not realistically exposed, and impact is confined to a temporary detection-engine restart rather than host compromise. |
| Impact | This is a moderate-severity availability-only flaw (CVSS 5.3, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity impact - the single consequence is a denial-of-service restart of the Snort 3 Detection Engine via an infinite loop (CWE-835). The network vector, low attack complexity, and no-authentication/no-interaction requirements make it easy to trigger in principle, but the real-world risk is bounded by two factors: the impact is limited to A:L (temporary detection-engine restart, not full device/code compromise) and exploitation depends on the affected device actually inspecting GPRS/GTP traffic. No EPSS score, CISA KEV listing, SSVC decision data, or public POC was provided in the input, so there are no signals of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' Signals are internally consistent (CVSS network/unauth vector matches the description of a crafted remote UDP datagram), so there is no conflict to flag, but the absence of EPSS/KEV/SSVC data means exploitation likelihood cannot be independently quantified. Net assessment: a legitimate patch-management priority for operators carrying GTP traffic through Snort 3 / Cisco FTD / UTD, but not an emergency relative to code-execution or data-exposure bugs. |
| Exploit ScenarioDerived | An unauthenticated remote attacker sends a crafted, fragmented UDP datagram containing malformed GTP extension headers across a network path inspected by an affected Snort 3 engine (e.g., a Cisco Secure Firewall Threat Defense appliance). The codec's flawed logic enters an infinite loop while processing the headers, causing the Snort 3 Detection Engine to restart and dropping traffic inspection during the outage. No public exploit code was identified in the provided data, and the low attack complexity (AC:L) means a single crafted packet stream is sufficient. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
An infinite-loop flaw in the Snort 3 Detection Engine's GTP codec lets remote, unauthenticated attackers restart the detection engine and disrupt inspection by sending a single crafted, fragmented UDP datagram carrying GTP extension headers (CVSS 5.3, availability-only, CWE-835). Cisco Open Source Snort 3, Cisco Secure Firewall Threat Defense (FTD) software, and Cisco UTD Snort IPS Engine software are all affected, but only deployments that actually inspect GTP traffic - typically mobile-core, telecom, or specifically configured sensor placements - are realistically reachable. No public exploit code or confirmed active exploitation was identified at time of analysis, and the outcome is a temporary detection-engine restart rather than host compromise; the practical risk is a window of lost or degraded inspection coverage.
RemediationAI
Cisco has published advisory cisco-sa-snort3-gtpcodec-dos-Rmecfepz (https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-gtpcodec-dos-Rmecfepz), and patched Snort 3 builds should be taken from that advisory's fixed-release table - for Secure Firewall Threat Defense this means the recommended FTD release listed there, and for open-source Snort 3 the corresponding upstream codec fix; the input data does not specify an exact fix version, so confirm the version against the advisory before upgrading. Because the vulnerable code path is the GTP codec, the most effective compensating control for environments that do not legitimately need GTP inspection is to stop inspecting GTP traffic: remove the GTP inspector from the Snort 3 configuration or restrict the sensor's inspection scope so UDP/2152 (GTP-U) and related GTP ports are not steered to the detection engine - the trade-off is complete loss of visibility into any tunnelled mobile-core traffic that traverses those paths. Where GTP inspection must be retained, reduce exposure by filtering fragmented UDP from untrusted network segments at the perimeter so the crafted fragmented datagrams cannot reach the inspection interface, accepting that legitimate fragmented GTP traffic from roaming/interconnect partners will also be dropped. Additionally, ensure detection-engine restart events are forwarded to monitoring so repeated crashes on a GTP-bearing inspection path can be treated as an active exploitation attempt, and apply the vendor patch as the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Snort 3 Detection Engine is the inspection core shared by Cisco's open-source IDS/IPS and several commercial Cisco products, including Secure Firewall Threat Defense (FTD) and the UTD Snort IPS Engine software. This flaw sits in the codec that parses GPRS Tunneling Protocol (GTP) traffic - the protocol used to carry subscriber data and signalling over mobile-core networks, generally transported inside UDP (GTP-U on port 2152). When a fragmented UDP datagram containing GTP extension headers is processed, flawed logic in the extension-header handling path causes the parser to loop without a terminating condition (CWE-835, Infinite Loop), so the detection engine stalls and ultimately restarts. The flaw is reachable pre-authentication over the network (AV:N/PR:N/UI:N) because GTP packets are parsed as they traverse the inspection path, but its blast radius is bounded to availability (C:N/I:N/A:L): there is no memory corruption, no code execution, and no exposure of inspected data implied by the assessed vector. Exploitation is conditional on the GTP codec being loaded and GTP traffic being routed through the sensor.
Know when Cisco Secure Firewall Threat Defense Ftd Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Remote crafted packet needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); only a temporary detection-engine restart, so C:N/I:N and A:L, scope unchanged.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition.
The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Improper access control defects in Cisco Secure Firewall ASA, FTD, and FMC software allow an authenticated, low-privileg
Multiple improper neutralization flaws in Cisco Secure Firewall ASA, Threat Defense (FTD), and Management Center (FMC) s
Improper handling of exceptional conditions across Cisco Secure Firewall ASA Software, Threat Defense (FTD) Software, an
Out-of-bounds write flaws in the Cisco Snort 3 inspection engine allow remote, unauthenticated attackers to corrupt memo
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (F
Unauthenticated attackers on an adjacent network segment can exploit multiple resource lifetime flaws (CWE-664) in Cisco
A denial of service vulnerability in the Internet Key Exchange (CVSS 8.6). High severity vulnerability requiring prompt
Sustained TCP SYN floods directed at Cisco Secure Firewall ASA and FTD devices can drive the appliance into high CPU uti
Crafted TLS 1.3 packets can crash the LINA process on Cisco Secure Firewall Threat Defense (FTD), forcing an unscheduled
Unauthenticated remote attackers can crash the IKEv2 process on Cisco Secure Firewall ASA and FTD software configured fo
Memory exhaustion in the sftunnel inter-device communication service of Cisco Secure Firewall Management Center (FMC) an
Unauthenticated, remote denial of service affecting Cisco Secure Firewall Adaptive Security Appliance (ASA) and Threat D
Exploit-DB