{"id":"CVE-2026-20065","title":"Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspect…","summary":"Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspect…","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","cwe":["CWE-667"],"vendor":"cisco","product":"snort","affected":["snort >= 3.0.0-233, < 3.6.3.0","secure_firewall_threat_defense = 7.0.0","secure_firewall_threat_defense = 7.0.0.1","secure_firewall_threat_defense = 7.0.1","secure_firewall_threat_defense = 7.0.1.1","secure_firewall_threat_defense = 7.0.2","secure_firewall_threat_defense = 7.0.2.1","secure_firewall_threat_defense = 7.0.3","secure_firewall_threat_defense = 7.0.4","secure_firewall_threat_defense = 7.0.5","secure_firewall_threat_defense = 7.0.6","secure_firewall_threat_defense = 7.0.6.1","secure_firewall_threat_defense = 7.0.6.2","secure_firewall_threat_defense = 7.0.6.3","secure_firewall_threat_defense = 7.0.7","secure_firewall_threat_defense = 7.0.8","secure_firewall_threat_defense = 7.0.8.1","secure_firewall_threat_defense = 7.1.0","secure_firewall_threat_defense = 7.1.0.1","secure_firewall_threat_defense = 7.1.0.2","secure_firewall_threat_defense = 7.1.0.3","secure_firewall_threat_defense = 7.2.0","secure_firewall_threat_defense = 7.2.0.1","secure_firewall_threat_defense = 7.2.1","secure_firewall_threat_defense = 7.2.2","secure_firewall_threat_defense = 7.2.3","secure_firewall_threat_defense = 7.2.4","secure_firewall_threat_defense = 7.2.4.1","secure_firewall_threat_defense = 7.2.5","secure_firewall_threat_defense = 7.2.5.1","secure_firewall_threat_defense = 7.2.5.2","secure_firewall_threat_defense = 7.2.6","secure_firewall_threat_defense = 7.2.7","secure_firewall_threat_defense = 7.2.8","secure_firewall_threat_defense = 7.2.8.1","secure_firewall_threat_defense = 7.2.9","secure_firewall_threat_defense = 7.2.10","secure_firewall_threat_defense = 7.2.10.2","secure_firewall_threat_defense = 7.3.0","secure_firewall_threat_defense = 7.3.1","secure_firewall_threat_defense = 7.3.1.1","secure_firewall_threat_defense = 7.3.1.2","secure_firewall_threat_defense = 7.4.0","secure_firewall_threat_defense = 7.4.1","secure_firewall_threat_defense = 7.4.1.1","secure_firewall_threat_defense = 7.4.2","secure_firewall_threat_defense = 7.4.2.1","secure_firewall_threat_defense = 7.4.2.2","secure_firewall_threat_defense = 7.4.2.3","secure_firewall_threat_defense = 7.4.2.4","secure_firewall_threat_defense = 7.6.0","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.2.1r","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.3","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.5","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.6","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.7","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1b","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.4","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.5","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.7","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.8.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.2a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5e","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5f","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7b","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.8","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.10.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.11.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4"],"patched":["snort 3.6.3.0"],"published":"2026-03-04","updated":"2026-08-19","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20065","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-multi-dos-XFWkWSwz","label":"psirt@cisco.com"}],"tags":["nvd"],"epss":0.00366,"epssPercentile":0.30419,"ingestedAt":"2026-08-20T17:59:04.277Z","slug":"CVE-2026-20065","body":"## Overview\n\nMultiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.\r\n\r\nThis vulnerability is due to an error in the binder module initialization logic of the Snort Detection Engine. An attacker could exploit this vulnerability by sending certain packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine restarts unexpectedly.\n\n## Affected\n\n- `snort >= 3.0.0-233, < 3.6.3.0`\n- `secure_firewall_threat_defense = 7.0.0`\n- `secure_firewall_threat_defense = 7.0.0.1`\n- `secure_firewall_threat_defense = 7.0.1`\n- `secure_firewall_threat_defense = 7.0.1.1`\n- `secure_firewall_threat_defense = 7.0.2`\n- `secure_firewall_threat_defense = 7.0.2.1`\n- `secure_firewall_threat_defense = 7.0.3`\n- `secure_firewall_threat_defense = 7.0.4`\n- `secure_firewall_threat_defense = 7.0.5`\n- `secure_firewall_threat_defense = 7.0.6`\n- `secure_firewall_threat_defense = 7.0.6.1`\n- `secure_firewall_threat_defense = 7.0.6.2`\n- `secure_firewall_threat_defense = 7.0.6.3`\n- `secure_firewall_threat_defense = 7.0.7`\n- `secure_firewall_threat_defense = 7.0.8`\n- `secure_firewall_threat_defense = 7.0.8.1`\n- `secure_firewall_threat_defense = 7.1.0`\n- `secure_firewall_threat_defense = 7.1.0.1`\n- `secure_firewall_threat_defense = 7.1.0.2`\n- `secure_firewall_threat_defense = 7.1.0.3`\n- `secure_firewall_threat_defense = 7.2.0`\n- `secure_firewall_threat_defense = 7.2.0.1`\n- `secure_firewall_threat_defense = 7.2.1`\n- `secure_firewall_threat_defense = 7.2.2`\n- `secure_firewall_threat_defense = 7.2.3`\n- `secure_firewall_threat_defense = 7.2.4`\n- `secure_firewall_threat_defense = 7.2.4.1`\n- `secure_firewall_threat_defense = 7.2.5`\n- `secure_firewall_threat_defense = 7.2.5.1`\n- `secure_firewall_threat_defense = 7.2.5.2`\n- `secure_firewall_threat_defense = 7.2.6`\n- `secure_firewall_threat_defense = 7.2.7`\n- `secure_firewall_threat_defense = 7.2.8`\n- `secure_firewall_threat_defense = 7.2.8.1`\n- `secure_firewall_threat_defense = 7.2.9`\n- `secure_firewall_threat_defense = 7.2.10`\n- `secure_firewall_threat_defense = 7.2.10.2`\n- `secure_firewall_threat_defense = 7.3.0`\n- `secure_firewall_threat_defense = 7.3.1`\n- `secure_firewall_threat_defense = 7.3.1.1`\n- `secure_firewall_threat_defense = 7.3.1.2`\n- `secure_firewall_threat_defense = 7.4.0`\n- `secure_firewall_threat_defense = 7.4.1`\n- `secure_firewall_threat_defense = 7.4.1.1`\n- `secure_firewall_threat_defense = 7.4.2`\n- `secure_firewall_threat_defense = 7.4.2.1`\n- `secure_firewall_threat_defense = 7.4.2.2`\n- `secure_firewall_threat_defense = 7.4.2.3`\n- `secure_firewall_threat_defense = 7.4.2.4`\n- `secure_firewall_threat_defense = 7.6.0`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.2.1r`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.3`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.5`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.6`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.7`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1b`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.4`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.5`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.7`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.8.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.2a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5e`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5f`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7b`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.8`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.10.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.11.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `snort 3.6.3.0`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}