{"id":"CVE-2026-121944","kind":"vulnerability","aliases":["CVE-2026-121944"],"related":[],"title":"sngrep: crafted NFLOG capture file makes packet capture hang","description":"sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, making the capture thread spin at full CPU and stop processing packets.","summary":"sngrep, a terminal SIP capture tool, can be sent a pcap file with a malformed NFLOG TLV that makes its capture thread loop forever at full CPU. An attacker gets a denial of service: packet processing stops.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","package","pcap","sip","sngrep"],"not_affected_if":["no-nflog-capture","sngrep-above-1.9.0"],"how_to_check":"- `sngrep --version` to find the installed version\n- Check whether sngrep is used to read pcap files with link type NFLOG","fix":null,"status":"open","published_at":"2026-11-04T13:17:29+00:00","first_seen_at":"2026-11-04T13:27:03+00:00","triaged_at":"2026-11-04T13:28:07+00:00","updated_at":"2026-11-04T13:28:07+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-04T13:28:07Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"sngrep: crafted NFLOG capture file makes packet capture hang","impact":"low","summary":"sngrep, a terminal SIP capture tool, can be sent a pcap file with a malformed NFLOG TLV that makes its capture thread loop forever at full CPU. An attacker gets a denial of service: packet processing stops.","audience":"businesses","category":"package","nicknames":[],"who_cares":["sngrep","sip","linux","pcap"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"capture thread spins forever; packet processing stops","analyst_note":"Confirm fixed version and whether live NFLOG capture is reachable, via the NVD entry and the VulnCheck advisory.","how_to_check":"- `sngrep --version` to find the installed version\n- Check whether sngrep is used to read pcap files with link type NFLOG","plain_action":"","needs_analyst":true,"not_affected_if":["no-nflog-capture","sngrep-above-1.9.0"],"who_is_affected":"Only systems running sngrep at or below 1.9.0 that open pcap files with NFLOG link type, or capture from an NFLOG source, are exposed. The sources say the attacker supplies the crafted pcap file, so systems that only capture live traffic from other interfaces are less likely to be reached. unknown whether live NFLOG capture is also affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000688,"input_tokens":4187,"output_tokens":538,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121944':12A,15A '-2026':11A,14A '1.9.0':60C '4':104C 'allow':74C 'attack':49B,75C,85C 'captur':4A,8A,25B,41B,67C,107C 'caus':77C 'contain':61C,95C 'cpu':47B,112C 'craft':2A,82C 'cve':10A,13A 'denial':52B,78C 'file':5A,32B,90C 'forev':44B 'full':46B,111C 'get':50B 'hang':9A 'infinit':63C 'ip':70C 'length':102C 'link':92C 'linux':16B 'loop':43B,64C 'make':6A,39B,105C 'malform':35B 'nflog':3A,36B,83C,94C 'non':98C 'non-payload':97C 'packag':17B 'packet':7A,55B,68C,116C 'payload':99C 'pcap':18B,31B,89C 'process':56B,115C 'reasm':69C 'sent':29B 'servic':54B,80C 'sip':19B,24B 'sngrep':1A,20B,21B,58C 'spin':109C 'src/capture.c':72C 'stop':57B,114C 'suppli':87C 'termin':23B 'thread':42B,108C 'tlv':37B,100C 'tlvs':84C 'tool':26B 'type':93C 'via':81C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Only systems running sngrep at or below 1.9.0 that open pcap files with NFLOG link type, or capture from an NFLOG source, are exposed. The sources say the attacker supplies the crafted pcap file, so systems that only capture live traffic from other interfaces are less likely to be reached. unknown whether live NFLOG capture is also affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linux","medium","package","pcap","sip","sngrep"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121944","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121944","severity":null,"published_at":"2026-11-04T13:17:29+00:00","modified_at":"2026-11-04T13:17:29+00:00","first_seen_at":"2026-11-04T13:27:03+00:00","fetched_at":"2026-11-04T13:27:03+00:00","note":null}],"documents":[{"id":67092,"url":"https://www.vulncheck.com/advisories/sngrep-through-1.9.0-infinite-loop-dos-via-crafted-nflog-tlv","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}