Strix
72.7K

CVE-2026-76445

MEDIUMCVSS 5.3/10

Last modified

CVE-2026-76445 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device.

Description

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.

Metrics

CVSS 3.1
5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness Enumeration

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
CiscoCisco Open Source Snort33.12.2.0; 3.1.2.0; 3.1.3.0; 3.1.4.0; 3.1.5.0; 3.1.6.0; 3.1.7.0; 3.1.8.0; 3.1.9.0; 3.1.10.0; 3.1.12.0; 3.1.13.0; 3.1.14.0; 3.1.15.0; 3.1.16.0; 3.1.17.0; 3.1.18.0; 3.1.19.0; 3.1.20.0; 3.1.21.0; 3.1.22.0; 3.1.23.0; 3.1.24.0; 3.1.25.0; 3.1.27.0; 3.1.28.0; 3.1.29.0; 3.1.30.0; 3.1.31.0; 3.1.32.0; 3.1.36.0; 3.1.38.0; 3.1.39.0; 3.1.40.0; 3.1.41.0; 3.1.42.0; 3.1.43.0; 3.1.45.0; 3.1.47.0; 3.1.48.0; 3.1.50.0; 3.1.51.0; 3.1.52.0; 3.1.53.0; 3.1.55.0; 3.1.56.0; 3.1.57.0; 3.1.58.0; 3.1.59.0; 3.1.60.0; 3.1.61.0; 3.1.62.0; 3.1.63.0; 3.1.64.0; 3.1.65.0; 3.1.66.0; 3.1.67.0; 3.1.69.0; 3.1.70.0; 3.1.71.0; 3.1.72.0; 3.1.73.0; 3.1.74.0; 3.1.75.0; 3.1.76.0; 3.1.77.0; 3.1.78.0; 3.1.81.0; 3.1.82.0; 3.1.83.0; 3.1.84.0; 3.2.1.0; 3.2.2.0; 3.3.0.0; 3.3.1.0; 3.3.2.0; 3.3.3.0; 3.3.4.0; 3.3.5.0; 3.3.7.0; 3.5.0.0; 3.5.1.0; 3.8.1.0; 3.6.0.0; 3.6.2.0; 3.9.3.0; 3.7.2.0; 3.7.0.0; 3.9.6.0; 3.10.0.0; 3.10.2.0; 3.7.4.0; 3.9.0.0; 3.5.2.0; 3.12.1.0; 3.6.1.0; 3.9.2.0; 3.6.3.0; 3.9.5.0; 3.7.1.0; 3.9.7.0; 3.7.3.0; 3.10.1.0; 3.9.1.0; 3.11.1.0
CiscoCisco Secure Firewall Threat Defense (FTD) Software7.0.0; 7.0.0.1; 7.0.1; 7.0.1.1; 7.0.2; 7.2.0; 7.0.2.1; 7.0.3; 7.2.0.1; 7.0.4; 7.2.1; 7.0.5; 7.3.0; 7.2.2; 7.2.3; 7.3.1; 7.2.4; 7.0.6; 7.2.5; 7.2.4.1; 7.3.1.1; 7.4.0; 7.0.6.1; 7.2.5.1; 7.4.1; 7.2.6; 7.0.6.2; 7.4.1.1; 7.2.7; 7.2.5.2; 7.3.1.2; 7.2.8; 7.6.0; 7.4.2; 7.2.8.1; 7.0.6.3; 7.4.2.1; 7.2.9; 7.0.7; 7.7.0; 7.4.2.2; 7.2.10; 7.6.1; 7.4.2.3; 7.0.8; 7.6.2; 7.7.10; 7.7.11; 7.0.8.1; 7.6.2.1; 7.7.10.1; 7.4.2.4; 7.2.10.2; 7.4.3; 7.6.4; 10.0.0; 7.4.4; 7.0.9; 7.2.11; 7.4.7
CiscoCisco UTD SNORT IPS Engine Software17.12.1a; 17.12.2; 17.12.3; 17.12.4; 17.12.3a; 17.15.1a; 17.12.4a; 17.15.2c; 17.12.4b; 17.15.2a; 17.12.5; 17.12.5a; 17.15.3a; 17.15.3; 17.12.5b; 17.12.5c; 17.15.4; 17.18.1; 17.18.1a; 17.12.6; 17.15.4c; 17.12.5d; 17.18.2; 17.15.5; 17.15.5a; 17.12.7; 17.12.7a; 17.12.7b; 17.18.3a; 17.12.8; 17.15.6; 17.18.4

References

Timeline

Published
Last Modified
Status
Awaiting Analysis

Frequently Asked Questions

What is CVE-2026-76445?
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition. The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.
How severe is CVE-2026-76445?
CVE-2026-76445 has a CVSS score of 5.3/10 (MEDIUM severity).
How do I fix CVE-2026-76445?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-76445?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST