/
← Voltar ao feed
medium

Cisco Snort 3 GRE decapsulation flaw (CVE-2026-20221) lets remote attacker crash detection engine

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 13:00 · coletado há 2 dias

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Cisco disclosed CVE-2026-20221, a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that affects multiple Cisco products. An unauthenticated, remote attacker can send a crafted GRE payload through an affected device to trigger an unexpected restart of the engine. Depending on device configuration, the result is either an inspection bypass or a denial of service (DoS). Cisco rates the Security Impact as Medium and has released software updates. No workarounds exist. The article does not report exploitation in the wild.

Detalhes técnicos

  • The root cause is improper handling of nested GRE traffic in the Snort 3 GRE decapsulation logic.
  • The attack needs no authentication and is launched remotely by sending a crafted GRE payload through the affected device.
  • A successful exploit forces an unexpected reload of the Snort 3 Detection Engine, which restarts automatically with no manual intervention.
  • Depending on configuration, the restart causes either traffic inspection bypass or DoS.
  • The advisory is part of the Cisco Advance Notification for the October 21, 2026 publication, alongside the Snort 3 Security Hardening Release: October 2026.

Remediação

  • Apply the Cisco software updates that address this vulnerability.
  • Cisco states there are no workarounds.
  • Consult the advisory cisco-sa-snort3-gre-JNpMHrTv for the list of affected products and fixed releases.

Linha do tempo

  1. sec.cloudapps.cisco.com ↗ · pub. 21/10/2026 13:00 · coletado 21/10 14:01 primeiro registro só resumo do feed

    Cisco Snort 3 GRE decapsulation flaw (CVE-2026-20221) lets remote attacker crash detection engine

    ler a análise desta fonte

    Cisco disclosed CVE-2026-20221, a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that affects multiple Cisco products. An unauthenticated, remote attacker can send a crafted GRE payload through an affected device to trigger an unexpected restart of the engine. Depending on device configuration, the result is either an inspection bypass or a denial of service (DoS). Cisco rates the Security Impact as Medium and has released software updates. No workarounds exist. The article does not report exploitation in the wild.

    Technical Details

    • The root cause is improper handling of nested GRE traffic in the Snort 3 GRE decapsulation logic.
    • The attack needs no authentication and is launched remotely by sending a crafted GRE payload through the affected device.
    • A successful exploit forces an unexpected reload of the Snort 3 Detection Engine, which restarts automatically with no manual intervention.
    • Depending on configuration, the restart causes either traffic inspection bypass or DoS.
    • The advisory is part of the Cisco Advance Notification for the October 21, 2026 publication, alongside the Snort 3 Security Hardening Release: October 2026.

    Remediation

    • Apply the Cisco software updates that address this vulnerability.
    • Cisco states there are no workarounds.
    • Consult the advisory cisco-sa-snort3-gre-JNpMHrTv for the list of affected products and fixed releases.