OTPulse

Multiple Cisco Products Snort 3 Denial of Service Vulnerability

MonitorCVSS 5.3cisco-sa-snort3-gtpcodec-dos-RmecfepzOct 21, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in Snort 3 Detection Engine allows an unauthenticated remote attacker to crash the detection engine by sending a crafted, fragmented UDP datagram containing malformed GTP extension headers. The codec's flaw in processing these headers causes an infinite loop, resulting in denial of service until the engine restarts. This causes temporary loss of intrusion detection capabilities.

What this means
What could happen
A remote attacker could send a malformed UDP packet to crash the Snort detection engine, temporarily blinding your network of intrusion detection until the service restarts and restoring visibility.
Who's at risk
Network security teams running Cisco Snort 3 detection engines on network sensors, firewalls, or intrusion detection/prevention systems (IDS/IPS). This affects security monitoring infrastructure deployed in water utilities, electric utilities, and industrial facilities that rely on Snort for real-time threat detection.
How it could be exploited
An attacker sends a crafted, fragmented UDP datagram containing malformed GTP (GPRS Tunneling Protocol) extension headers to the Snort 3 Detection Engine. The codec mishandles the headers, causing an infinite loop that crashes the detection engine and causes a denial of service.
Prerequisites
  • Network access to the Snort 3 Detection Engine on the affected device
  • Ability to send UDP traffic to the detection engine
remotely exploitableno authentication requiredlow complexityaffects network visibility
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (1)
ProductAffected VersionsFix Status
Multiple Cisco Products Snort 317.12.1a through 3.9.7.0Fix available
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Snort 3 to version 3.9.8.0 or later
View full vendor advisory
API: /api/v1/advisories/1962fbea-364b-447a-af4e-136a0aff1261

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.