/
← Voltar ao feed
medium

Cisco Snort 3 GTP codec flaw (CVE-2026-76445) lets remote attackers trigger infinite loop and DoS via fragmented UDP

1 fonte(s) · 1 atualização(ões) · publicado 21/10/2026 13:00 · coletado há 1 dia

Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗

Cisco disclosed CVE-2026-76445, a medium-severity vulnerability in the Snort 3 Detection Engine that affects multiple Cisco products. An unauthenticated, remote attacker can send a crafted, fragmented UDP datagram containing GPRS Tunneling Protocol (GTP) extension headers. This makes the detection engine enter an infinite loop and restart unexpectedly, causing a denial-of-service condition. Cisco has released software updates, and workarounds are available. The advisory is part of the Cisco October 21, 2026 advance-notification bundle and relates to the Snort 3 Security Hardening Release of October 2026. The article does not report exploitation in the wild.

Detalhes técnicos

  • Root cause: a flaw in logic handling when GTP extension headers are processed within the Snort 3 codec.
  • Exploitation: a crafted, fragmented UDP datagram with GTP extension headers is sent to the Snort 3 Detection Engine of an affected device.
  • Impact: the detection engine enters an infinite loop and restarts, interrupting traffic inspection (DoS).
  • Cisco rates the Security Impact as Medium.

Remediação

  • Apply the Cisco software updates that address the vulnerability.
  • Workarounds exist; see advisory cisco-sa-snort3-gtpcodec-dos-Rmecfepz for details.
  • Review the Snort 3 Security Hardening Release: October 2026 for related fixes in open source Snort 3.

Linha do tempo

  1. sec.cloudapps.cisco.com ↗ · pub. 21/10/2026 13:00 · coletado 21/10 14:01 primeiro registro só resumo do feed

    Cisco Snort 3 GTP codec flaw (CVE-2026-76445) lets remote attackers trigger infinite loop and DoS via fragmented UDP

    ler a análise desta fonte

    Cisco disclosed CVE-2026-76445, a medium-severity vulnerability in the Snort 3 Detection Engine that affects multiple Cisco products. An unauthenticated, remote attacker can send a crafted, fragmented UDP datagram containing GPRS Tunneling Protocol (GTP) extension headers. This makes the detection engine enter an infinite loop and restart unexpectedly, causing a denial-of-service condition. Cisco has released software updates, and workarounds are available. The advisory is part of the Cisco October 21, 2026 advance-notification bundle and relates to the Snort 3 Security Hardening Release of October 2026. The article does not report exploitation in the wild.

    Technical Details

    • Root cause: a flaw in logic handling when GTP extension headers are processed within the Snort 3 codec.
    • Exploitation: a crafted, fragmented UDP datagram with GTP extension headers is sent to the Snort 3 Detection Engine of an affected device.
    • Impact: the detection engine enters an infinite loop and restarts, interrupting traffic inspection (DoS).
    • Cisco rates the Security Impact as Medium.

    Remediation

    • Apply the Cisco software updates that address the vulnerability.
    • Workarounds exist; see advisory cisco-sa-snort3-gtpcodec-dos-Rmecfepz for details.
    • Review the Snort 3 Security Hardening Release: October 2026 for related fixes in open source Snort 3.