{"id":"CVE-2026-76489","kind":"vulnerability","aliases":["CVE-2026-76489"],"related":[],"title":"Cisco Snort 3: unreleased memory from file processing enables remote denial of service","description":"Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.\r\n\r\nThis vulnerability is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory. An attacker could exploit this vulnerability by sending a large number of files to be processed. A successful exploit could allow the attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a DoS condition.","summary":"Snort 3, the intrusion detection engine shipped in several Cisco products, fails to release memory when it processes files, so a large number of files can make it restart. An unauthenticated remote attacker can interrupt packet inspection, causing a denial of service.","severity":"medium","cvss":5.8,"epss":0.00316,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cisco","infrastructure","intrusion-detection","network-security","snort"],"not_affected_if":["no-snort-3"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-21T17:19:08+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:10:00+00:00","updated_at":"2026-10-25T04:10:00+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-25T04:10:00Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Cisco Snort 3: unreleased memory from file processing enables remote denial of service","impact":"low","summary":"Snort 3, the intrusion detection engine shipped in several Cisco products, fails to release memory when it processes files, so a large number of files can make it restart. An unauthenticated remote attacker can interrupt packet inspection, causing a denial of service.","category":"infrastructure","nicknames":[],"who_cares":["cisco","snort","network-security","intrusion-detection"],"confidence":0.6,"needs_auth":"no","worst_case":"Detection engine restarts repeatedly, halting packet inspection until fixed","analyst_note":"Find the affected Cisco product list and fixed versions in the Cisco advisory linked from the NVD record.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-snort-3"],"who_is_affected":"Organisations running Cisco products that embed Snort 3 for intrusion detection or prevention are affected, and the sources do not list the specific product versions. Teams that do not run a Cisco product with Snort 3 inspection can skip it. unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000567,"input_tokens":3458,"output_tokens":442,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-76489':16A,19A '3':3A,30B,86C,98C,120C,155C 'affect':75C 'allow':89C,148C 'attack':61B,93C,129C,150C 'caus':66B,95C,125C,152C 'check':117C 'cisco':1A,20B,38B,72C 'condit':165C 'could':88C,124C,130C,147C 'cve':14A,17A 'denial':11A,68B 'detect':24B,33B,99C,156C 'dos':164C 'due':113C 'enabl':9A 'engin':34B,100C,157C 'error':116C 'exploit':131C,146C 'fail':40B 'file':7A,47B,53B,122C,140C 'implement':83C 'incomplet':115C 'infrastructur':21B 'inspect':65B,109C 'interrupt':63B,106C 'intrus':23B,32B 'intrusion-detect':22B 'larg':50B,137C 'make':55B 'manag':82C 'memori':5A,43B,81C,127C 'multipl':71C 'network':26B 'network-secur':25B 'number':51B,138C 'packet':64B,108C 'process':8A,46B,121C,143C 'product':39B,73C 'releas':42B 'remot':10A,60B,92C 'restart':57B,102C,159C 'result':103C,161C 'secur':27B 'send':135C 'servic':13A,70B 'sever':37B 'ship':35B 'snort':2A,28B,29B,85C,97C,119C,154C 'success':145C 'unauthent':59B,91C 'unexpect':160C 'unreleas':4A,126C 'vulner':78C,111C,133C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Cisco products that embed Snort 3 for intrusion detection or prevention are affected, and the sources do not list the specific product versions. Teams that do not run a Cisco product with Snort 3 inspection can skip it. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T17:19:08+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","cvss_by":"psirt@cisco.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-76489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-76489","severity":null,"published_at":"2026-10-21T17:19:08+00:00","modified_at":"2026-10-22T14:17:47+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-76489","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-76489","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}