SB20261021126 - Multiple vulnerabilities in Snort

Main Vulnerability Database SB20261021126

SB20261021126 - Multiple vulnerabilities in Snort

Published: October 21, 2026

Security Bulletin ID SB20261021126

CSH Severity

Medium

Patch available

YES

Number of vulnerabilities 8

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 8 vulnerabilities.

1) Missing Authentication for Critical Function (CVE-ID: CVE-2026-76524)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to execute arbitrary commands as the Snort 3 process user and read and write Snort 3 process memory.

The vulnerability exists due to missing authentication in the Snort 3 control channel socket implementation when handling local connections. A local user can connect to the control channel socket to execute arbitrary commands as the Snort 3 process user and read and write its memory.

2) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-20019)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by triggering an unexpected restart of the Snort 3 Detection Engine, interrupting packet inspection.

The vulnerability exists due to incomplete error checking in the Snort 3 NetFlow Detection Engine when parsing UDP NetFlow Protocol packets. A remote attacker can send a single crafted NetFlow packet through an established connection to be parsed by Snort 3 to trigger an unexpected engine restart and interrupt packet inspection.

Open Source Snort 3 is affected only when configured to parse Netflow Protocol connections.

3) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-20179)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by triggering an unexpected restart of the Snort 3 Detection Engine, interrupting packet inspection.

The vulnerability exists due to incomplete error checking in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine when parsing GRE packets. A remote attacker can send a crafted GRE packet to a targeted device for Snort 3 to parse to trigger an unexpected engine restart and interrupt packet inspection.

Open Source Snort 3 is affected only when configured to parse Netflow Protocol connections.

4) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2026-20197)

CWE-ID: CWE-754 - Improper Check for Unusual or Exceptional Conditions

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by triggering an unexpected restart of the Snort 3 Detection Engine, interrupting packet inspection.

The vulnerability exists due to incomplete error checking in the Snort 3 Teredo Detection Engine when parsing Teredo packets. A remote attacker can send a crafted Teredo packet to a targeted device for Snort 3 to parse to trigger an unexpected engine restart and interrupt packet inspection.

Open Source Snort 3 is affected only when configured to parse Netflow Protocol connections.

5) Memory leak (CVE-ID: CVE-2026-76489)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by exhausting memory and triggering an unexpected restart of the Snort 3 Detection Engine, interrupting packet inspection.

The vulnerability exists due to a failure to release memory caused by incomplete error checking in the Snort 3 memory management implementation when processing files. A remote attacker can send a large number of files for processing to exhaust memory and trigger an unexpected engine restart that interrupts packet inspection.

Open Source Snort 3 is affected only when configured to parse Netflow Protocol connections.

6) Infinite loop (CVE-ID: CVE-2026-76445)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service in the Snort 3 Detection Engine.

The vulnerability exists due to a logic error in the Snort 3 GTP codec when processing General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers. A remote attacker can send a crafted, fragmented UDP datagram containing these headers to trigger an infinite loop and cause a denial of service.

On Cisco Secure Firewall Threat Defense devices, Snort 3 must be active for exploitation.

7) NULL pointer dereference (CVE-ID: CVE-2026-20221)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service or bypass traffic inspection, depending on device configuration.

The vulnerability exists due to a null pointer dereference in the GRE tunnel decapsulation feature of the Snort 3 Detection Engine when processing nested GRE traffic. A remote attacker can send a crafted GRE payload through an affected device to trigger an unexpected engine restart, resulting in a denial of service or an inspection bypass depending on device configuration.

On Cisco IOS XE devices, exploitation requires the Unified Threat Defense (UTD) package to be installed.

8) Stack-based buffer overflow (CVE-ID: CVE-2026-20218)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by triggering an unexpected restart of the Snort 3 Detection Engine.

The vulnerability exists due to a stack-based buffer overflow caused by improper range checking in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine when decompressing user-controlled VBA data. A remote attacker can send specially crafted VBA data to the Snort 3 Detection Engine of a targeted device to overflow stack data and cause a denial of service.

Cisco Secure Firewall Threat Defense deployments are affected only when Snort 3 is configured and at least one Snort 3 Detector is configured for VBA macro decompression.

Remediation

Install update from vendor's website.

References