CVE-2026-121944 · Package
NO FIX YET
sngrep, a terminal SIP capture tool, can be sent a pcap file with a malformed NFLOG TLV that makes its capture thread loop forever at full CPU. An attacker gets a denial of service: packet processing stops.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only systems running sngrep at or below 1.9.0 that open pcap files with NFLOG link type, or capture from an NFLOG source, are exposed. The sources say the attacker supplies the crafted pcap file, so systems that only capture live traffic from other interfaces are less likely to be reached. unknown whether live NFLOG capture is also affected.
Not affected if no-nflog-capture, sngrep-above-1.9.0
Who cares linux, pcap, sip, sngrep
sngrep --version to find the installed versionNo fix yet, per the sources.
sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, making the capture thread spin at full CPU and stop processing packets.
This page as .md · .json · in your agent: get_signal("CVE-2026-121944") · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.