---
id: "CVE-2026-76445"
kind: "vulnerability"
aliases: ["CVE-2026-76445"]
title: "Cisco Snort 3: crafted GTP fragmented UDP packet causes detection engine restart"
severity: "medium"
cvss: 5.3
epss: 0.00416
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cisco", "network-appliance", "package", "snort-3"]
not_affected_if: ["no-gtp-inspection", "snort-2-only"]
published_at: "2026-10-21T17:19:06+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:20:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76445", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-76445", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# Cisco Snort 3: crafted GTP fragmented UDP packet causes detection engine restart

A flaw in how the Snort 3 detection engine handles GTP extension headers in fragmented UDP datagrams can send it into an infinite loop. An unauthenticated remote attacker can use this to force the detection engine to restart, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-76445
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-76445

## From the sources

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the detection engine to unexpectedly restart, resulting in a denial of service (DoS) condition.

The vulnerability is due to a flaw in logic handling when General Packet Radio Service (GPRS) Tunneling Protocol (GTP) extension headers are processed within the codec. An attacker could exploit this vulnerability by sending a crafted, fragmented UDP datagram that contains these headers to the Snort 3 Detection Engine of an affected device. A successful exploit could allow the attacker to cause the detection engine to enter an infinite loop, resulting in a DoS condition.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_