Live › vulnerability › CVE-2026-20221
Go to dashboardCisco's Snort 3 Detection Engine mishandles nested GRE tunnel traffic, so a crafted GRE packet sent through an affected device makes Snort restart. The restart can cause a denial of service or let traffic bypass inspection, depending on device configuration.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Cisco products that run the Snort 3 Detection Engine with GRE tunnel decapsulation are affected, and the sources do not list which product versions. Devices that do not run Snort 3 or do not process GRE tunnels are likely outside the issue, but the sources do not confirm this.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine.
This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.
This page as .md · .json · in your agent: get_signal("CVE-2026-20221")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.