{"id":"CVE-2026-20356","kind":"vulnerability","aliases":["CVE-2026-20356"],"related":[],"title":"Snort 3: multiple uncontrolled resource consumption flaws found in review","description":"As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.\r\n\r\nThe vulnerabilities tracked by CVE-2026-20356 are related to issues concerning uncontrolled resource consumption that are grouped under the Common Weakness Enumeration (CWE) Base CWE-400.","summary":"Cisco's internal review of Open Source Snort 3 found several flaws that consume resources without limit (CWE-400), fixed in hardening releases. The sources do not say what triggers them or what an attacker gets beyond resource exhaustion.","severity":"high","cvss":7.5,"epss":0.00346,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cisco","infrastructure","network-security","snort"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- Move Snort 3 to a hardened release from Cisco's advisory; the exact fixed version is not in the sources","status":"open","published_at":"2026-10-21T17:18:28+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T03:16:33+00:00","updated_at":"2026-10-25T03:16:33+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T03:16:33Z","model":"claude-haiku-5-5","output":{"fix":"- Move Snort 3 to a hardened release from Cisco's advisory; the exact fixed version is not in the sources","reach":"network","title":"Snort 3: multiple uncontrolled resource consumption flaws found in review","impact":"medium","summary":"Cisco's internal review of Open Source Snort 3 found several flaws that consume resources without limit (CWE-400), fixed in hardening releases. The sources do not say what triggers them or what an attacker gets beyond resource exhaustion.","category":"infrastructure","nicknames":[],"who_cares":["snort","network-security","cisco"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Snort 3 exhausts memory or CPU, stopping inspection","analyst_note":"Find the Cisco security advisory for CVE-2026-20356 to get fixed versions, triggering traffic and configuration, and whether a denial of service is the only outcome.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Teams running Snort 3 as an intrusion detection or prevention engine. The sources do not say which configurations or traffic patterns trigger the resource exhaustion, so whether a given deployment is exposed is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00058,"input_tokens":3427,"output_tokens":474,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A,110C '-20356':13A,16A,111C '-400':41B,131C '3':2A,31B,81C 'address':100C 'attack':57B 'base':129C 'beyond':59B 'cisco':17B,23B,65C,76C 'commit':68C 'common':125C 'comprehens':88C 'concern':116C 'conduct':86C 'consum':36B 'consumpt':6A,119C 'cve':11A,14A,109C 'cwe':40B,128C,130C 'discov':103C 'engin':83C 'enumer':127C 'exhaust':61B 'fix':42B 'flaw':7A,34B 'found':8A,32B 'get':58B 'group':122C 'harden':44B,97C 'infrastructur':18B 'intern':25B,89C,102C 'issu':115C 'limit':39B 'multipl':3A,101C 'network':20B 'network-secur':19B 'ongo':67C 'open':28B,78C 'own':77C 'part':63C 'proactiv':70C 'product':73C 'qualiti':74C 'relat':113C 'releas':45B,98C 'resourc':5A,37B,60B,118C 'result':94C 'review':10A,26B,91C,93C 'say':50B 'secur':21B,71C,90C 'sever':33B 'snort':1A,22B,30B,80C 'softwar':82C,96C 'sourc':29B,47B,79C 'team':84C 'track':107C 'trigger':52B 'uncontrol':4A,117C 'vulner':104C,106C 'weak':126C 'without':38B","nicknames":[],"mitigations":[],"who_affected":"Teams running Snort 3 as an intrusion detection or prevention engine. The sources do not say which configurations or traffic patterns trigger the resource exhaustion, so whether a given deployment is exposed is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:18:28+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-20356","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20356","severity":null,"published_at":"2026-10-21T17:18:28+00:00","modified_at":"2026-10-22T14:17:41+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-20356","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-20356","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}