Live › vulnerability › CVE-2026-76445
Go to dashboardA flaw in how the Snort 3 detection engine handles GTP extension headers in fragmented UDP datagrams can send it into an infinite loop. An unauthenticated remote attacker can use this to force the detection engine to restart, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Cisco products that embed the Snort 3 detection engine and process GTP traffic are affected, according to the NVD description. The sources do not list specific product versions or which Cisco products ship it, so teams should check their Cisco appliances and software for Snort 3 use.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition.
The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.
This page as .md · .json · in your agent: get_signal("CVE-2026-76445")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.