{"id":"CVE-2026-20066","title":"Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspect…","summary":"Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspect…","severity":"medium","cvss":5.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","cwe":["CWE-400"],"vendor":"cisco","product":"snort","affected":["snort >= 3.0.0-233, < 3.9.7.0","secure_firewall_threat_defense = 7.4.0","secure_firewall_threat_defense = 7.4.1","secure_firewall_threat_defense = 7.4.1.1","secure_firewall_threat_defense = 7.4.2","secure_firewall_threat_defense = 7.4.2.1","secure_firewall_threat_defense = 7.4.2.2","secure_firewall_threat_defense = 7.4.2.3","secure_firewall_threat_defense = 7.4.2.4","secure_firewall_threat_defense = 7.4.3","secure_firewall_threat_defense = 7.6.0","secure_firewall_threat_defense = 7.6.1","secure_firewall_threat_defense = 7.6.2","secure_firewall_threat_defense = 7.6.2.1","secure_firewall_threat_defense = 7.7.0","secure_firewall_threat_defense = 7.7.10","secure_firewall_threat_defense = 7.7.10.1","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.2.1r","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.3","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.5","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.6","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.7","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1b","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.4","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.5","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.7","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.8.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.2a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5e","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5f","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7b","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.8","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.10.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.11.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5c","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5d","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.6","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.13.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.14.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2c","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4c","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.16.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.17.1","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1a","unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.2"],"patched":["snort 3.9.7.0"],"published":"2026-03-04","updated":"2026-08-19","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20066","references":[{"url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-multi-dos-XFWkWSwz","label":"psirt@cisco.com"}],"tags":["nvd"],"epss":0.00454,"epssPercentile":0.38655,"ingestedAt":"2026-08-20T17:59:04.317Z","slug":"CVE-2026-20066","body":"## Overview\n\nMultiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.\r\n\r\nThis vulnerability is due to an error in the JSTokenizer normalization logic when the HTTP inspection normalizes JavaScript. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine restarts unexpectedly. JSTokenizer is not enabled by default.\n\n## Affected\n\n- `snort >= 3.0.0-233, < 3.9.7.0`\n- `secure_firewall_threat_defense = 7.4.0`\n- `secure_firewall_threat_defense = 7.4.1`\n- `secure_firewall_threat_defense = 7.4.1.1`\n- `secure_firewall_threat_defense = 7.4.2`\n- `secure_firewall_threat_defense = 7.4.2.1`\n- `secure_firewall_threat_defense = 7.4.2.2`\n- `secure_firewall_threat_defense = 7.4.2.3`\n- `secure_firewall_threat_defense = 7.4.2.4`\n- `secure_firewall_threat_defense = 7.4.3`\n- `secure_firewall_threat_defense = 7.6.0`\n- `secure_firewall_threat_defense = 7.6.1`\n- `secure_firewall_threat_defense = 7.6.2`\n- `secure_firewall_threat_defense = 7.6.2.1`\n- `secure_firewall_threat_defense = 7.7.0`\n- `secure_firewall_threat_defense = 7.7.10`\n- `secure_firewall_threat_defense = 7.7.10.1`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.2.1r`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.3`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.5`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.6`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.7`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1b`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.4`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.5`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.7`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.8.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.2a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5e`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5f`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7b`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.8`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.10.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.11.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5c`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5d`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.6`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.13.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.14.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2c`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4c`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.16.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.17.1`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1a`\n- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `snort 3.9.7.0`","depth":"sunlit","depthScore":32,"depthScoreParts":{"impact":31.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}