OTPulse

Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability

MonitorCVSS 5.8cisco-sa-snort3-mime-vulns-bkXjcKktOct 21, 2026
Cisco
IT in OT - Cisco networking products are commonly deployed in OT environments
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

A vulnerability in Snort 3 SMTP MIME Decoder (versions 16.12.1a through 3.9.7.0) allows an unauthenticated remote attacker to crash the Snort 3 Detection Engine by sending crafted SMTP packets with malformed MIME headers. The vulnerability exists due to insufficient error checking when parsing MIME fields in SMTP headers. A successful exploit causes the detection engine to restart unexpectedly, resulting in a denial of service condition. No workarounds are available; vendor patches are required.

What this means
What could happen
An attacker can send crafted SMTP email packets through the network, causing Snort 3 to crash and restart, which temporarily disables threat detection and monitoring on your network.
Who's at risk
Network security teams running Cisco Snort 3 intrusion detection/prevention systems should prioritize this update. Any organization relying on Snort 3 for SMTP inspection in email gateways or network perimeter monitoring is affected.
How it could be exploited
An attacker sends malformed SMTP packets with crafted MIME headers over the network to a system where Snort 3 is inspecting SMTP traffic. When Snort 3 parses these packets without proper error checking, the detection engine crashes and restarts, causing a temporary gap in network monitoring.
Prerequisites
  • Snort 3 must be deployed and actively monitoring SMTP traffic
  • Network path exists for attacker to send SMTP traffic to a monitored segment
remotely exploitableno authentication requiredlow complexityaffects network monitoring capability
Exploitability
Unlikely to be exploited — EPSS score 0.4%
Affected products (1)
ProductAffected VersionsFix Status
Multiple Cisco Products Snort 3 SMTP MIME16.12.1a through 3.9.7.0Fix available
Remediation & Mitigation
0/1
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Snort 3 to version 3.9.8.0 or later
View full vendor advisory
API: /api/v1/advisories/ffddfaa7-26f9-43dc-a471-1a2bf22a316b

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability | CVSS 5.8 - OTPulse