{"id":"CVE-2026-76445","kind":"vulnerability","aliases":["CVE-2026-76445"],"related":[],"title":"Cisco Snort 3: crafted GTP fragmented UDP packet causes detection engine restart","description":"Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition.\r\n\r\nThe vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.","summary":"A flaw in how the Snort 3 detection engine handles GTP extension headers in fragmented UDP datagrams can send it into an infinite loop. An unauthenticated remote attacker can use this to force the detection engine to restart, causing denial of service.","severity":"medium","cvss":5.3,"epss":0.00416,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cisco","network-appliance","package","snort-3"],"not_affected_if":["no-gtp-inspection","snort-2-only"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-21T17:19:06+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:20:49+00:00","updated_at":"2026-10-25T04:20:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:20:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Cisco Snort 3: crafted GTP fragmented UDP packet causes detection engine restart","impact":"low","summary":"A flaw in how the Snort 3 detection engine handles GTP extension headers in fragmented UDP datagrams can send it into an infinite loop. An unauthenticated remote attacker can use this to force the detection engine to restart, causing denial of service.","category":"package","nicknames":[],"who_cares":["cisco","snort-3","network-appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"detection engine restarts, causing denial of service on the device","analyst_note":"Find Cisco's advisory and the list of affected products and fixed versions; NVD text does not name them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["snort-2-only","no-gtp-inspection"],"who_is_affected":"Cisco products that embed the Snort 3 detection engine and process GTP traffic are affected, according to the NVD description. The sources do not list specific product versions or which Cisco products ship it, so teams should check their Cisco appliances and software for Snort 3 use.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000572,"input_tokens":3505,"output_tokens":444,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-3':25B '-76445':15A,18A '3':3A,32B,79C,151C 'affect':72C,156C 'allow':84C,162C 'applianc':22B 'attack':53B,88C,132C,164C 'caus':9A,64B,90C,166C 'cisco':1A,19B,69C 'codec':130C 'condit':104C,179C 'contain':145C 'could':83C,133C,161C 'craft':4A,140C 'cve':13A,16A 'datagram':42B,143C 'denial':65B,100C 'detect':10A,33B,60B,80C,92C,152C,168C 'devic':157C 'dos':103C,178C 'due':108C 'engin':11A,34B,61B,81C,93C,153C,169C 'enter':171C 'exploit':134C,160C 'extens':37B,124C 'flaw':27B,111C 'forc':58B 'fragment':6A,40B,141C 'general':116C 'gprs':120C 'gtp':5A,36B,123C 'handl':35B,114C 'header':38B,125C,147C 'infinit':48B,173C 'logic':113C 'loop':49B,174C 'multipl':68C 'network':21B 'network-appli':20B 'packag':23B 'packet':8A,117C 'process':127C 'product':70C 'protocol':122C 'radio':118C 'remot':52B,87C 'restart':12A,63B,96C 'result':97C,175C 'send':44B,138C 'servic':67B,102C,119C 'snort':2A,24B,31B,78C,150C 'success':159C 'tunnel':121C 'udp':7A,41B,142C 'unauthent':51B,86C 'unexpect':95C 'use':55B 'vulner':75C,106C,136C 'within':128C","nicknames":[],"mitigations":[],"who_affected":"Cisco products that embed the Snort 3 detection engine and process GTP traffic are affected, according to the NVD description. The sources do not list specific product versions or which Cisco products ship it, so teams should check their Cisco appliances and software for Snort 3 use.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:19:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76445","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76445","severity":null,"published_at":"2026-10-21T17:19:06+00:00","modified_at":"2026-10-22T14:17:45+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76445","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76445","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}