---
id: CVE-2026-20065
title: >-
  Multiple Cisco products are affected by a vulnerability in the Snort 3
  Detection Engine that could allow an unauthenticated, remote attacker to cause
  the Snort 3 Detection Engine to restart, resulting in an interruption of
  packet inspect…
summary: >-
  Multiple Cisco products are affected by a vulnerability in the Snort 3
  Detection Engine that could allow an unauthenticated, remote attacker to cause
  the Snort 3 Detection Engine to restart, resulting in an interruption of
  packet inspect…
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L'
cwe:
  - CWE-667
vendor: cisco
product: snort
affected:
  - 'snort >= 3.0.0-233, < 3.6.3.0'
  - secure_firewall_threat_defense = 7.0.0
  - secure_firewall_threat_defense = 7.0.0.1
  - secure_firewall_threat_defense = 7.0.1
  - secure_firewall_threat_defense = 7.0.1.1
  - secure_firewall_threat_defense = 7.0.2
  - secure_firewall_threat_defense = 7.0.2.1
  - secure_firewall_threat_defense = 7.0.3
  - secure_firewall_threat_defense = 7.0.4
  - secure_firewall_threat_defense = 7.0.5
  - secure_firewall_threat_defense = 7.0.6
  - secure_firewall_threat_defense = 7.0.6.1
  - secure_firewall_threat_defense = 7.0.6.2
  - secure_firewall_threat_defense = 7.0.6.3
  - secure_firewall_threat_defense = 7.0.7
  - secure_firewall_threat_defense = 7.0.8
  - secure_firewall_threat_defense = 7.0.8.1
  - secure_firewall_threat_defense = 7.1.0
  - secure_firewall_threat_defense = 7.1.0.1
  - secure_firewall_threat_defense = 7.1.0.2
  - secure_firewall_threat_defense = 7.1.0.3
  - secure_firewall_threat_defense = 7.2.0
  - secure_firewall_threat_defense = 7.2.0.1
  - secure_firewall_threat_defense = 7.2.1
  - secure_firewall_threat_defense = 7.2.2
  - secure_firewall_threat_defense = 7.2.3
  - secure_firewall_threat_defense = 7.2.4
  - secure_firewall_threat_defense = 7.2.4.1
  - secure_firewall_threat_defense = 7.2.5
  - secure_firewall_threat_defense = 7.2.5.1
  - secure_firewall_threat_defense = 7.2.5.2
  - secure_firewall_threat_defense = 7.2.6
  - secure_firewall_threat_defense = 7.2.7
  - secure_firewall_threat_defense = 7.2.8
  - secure_firewall_threat_defense = 7.2.8.1
  - secure_firewall_threat_defense = 7.2.9
  - secure_firewall_threat_defense = 7.2.10
  - secure_firewall_threat_defense = 7.2.10.2
  - secure_firewall_threat_defense = 7.3.0
  - secure_firewall_threat_defense = 7.3.1
  - secure_firewall_threat_defense = 7.3.1.1
  - secure_firewall_threat_defense = 7.3.1.2
  - secure_firewall_threat_defense = 7.4.0
  - secure_firewall_threat_defense = 7.4.1
  - secure_firewall_threat_defense = 7.4.1.1
  - secure_firewall_threat_defense = 7.4.2
  - secure_firewall_threat_defense = 7.4.2.1
  - secure_firewall_threat_defense = 7.4.2.2
  - secure_firewall_threat_defense = 7.4.2.3
  - secure_firewall_threat_defense = 7.4.2.4
  - secure_firewall_threat_defense = 7.6.0
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.2.1r
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.2
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.3
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.5
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.6
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.7
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1b
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.2
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.2
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.4
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.5
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.7
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.2
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.8.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.2a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5e
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5f
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7b
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.8
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.10.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.11.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a
  - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4
patched:
  - snort 3.6.3.0
published: '2026-03-04'
updated: '2026-08-19'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-20065'
references:
  - url: >-
      https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-multi-dos-XFWkWSwz
    label: psirt@cisco.com
tags:
  - nvd
epss: 0.00366
epssPercentile: 0.27632
ingestedAt: '2026-08-20T17:59:04.277Z'
---

## Overview

Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection.

This vulnerability is due to an error in the binder module initialization logic of the Snort Detection Engine. An attacker could exploit this vulnerability by sending certain packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine restarts unexpectedly.

## Affected

- `snort >= 3.0.0-233, < 3.6.3.0`
- `secure_firewall_threat_defense = 7.0.0`
- `secure_firewall_threat_defense = 7.0.0.1`
- `secure_firewall_threat_defense = 7.0.1`
- `secure_firewall_threat_defense = 7.0.1.1`
- `secure_firewall_threat_defense = 7.0.2`
- `secure_firewall_threat_defense = 7.0.2.1`
- `secure_firewall_threat_defense = 7.0.3`
- `secure_firewall_threat_defense = 7.0.4`
- `secure_firewall_threat_defense = 7.0.5`
- `secure_firewall_threat_defense = 7.0.6`
- `secure_firewall_threat_defense = 7.0.6.1`
- `secure_firewall_threat_defense = 7.0.6.2`
- `secure_firewall_threat_defense = 7.0.6.3`
- `secure_firewall_threat_defense = 7.0.7`
- `secure_firewall_threat_defense = 7.0.8`
- `secure_firewall_threat_defense = 7.0.8.1`
- `secure_firewall_threat_defense = 7.1.0`
- `secure_firewall_threat_defense = 7.1.0.1`
- `secure_firewall_threat_defense = 7.1.0.2`
- `secure_firewall_threat_defense = 7.1.0.3`
- `secure_firewall_threat_defense = 7.2.0`
- `secure_firewall_threat_defense = 7.2.0.1`
- `secure_firewall_threat_defense = 7.2.1`
- `secure_firewall_threat_defense = 7.2.2`
- `secure_firewall_threat_defense = 7.2.3`
- `secure_firewall_threat_defense = 7.2.4`
- `secure_firewall_threat_defense = 7.2.4.1`
- `secure_firewall_threat_defense = 7.2.5`
- `secure_firewall_threat_defense = 7.2.5.1`
- `secure_firewall_threat_defense = 7.2.5.2`
- `secure_firewall_threat_defense = 7.2.6`
- `secure_firewall_threat_defense = 7.2.7`
- `secure_firewall_threat_defense = 7.2.8`
- `secure_firewall_threat_defense = 7.2.8.1`
- `secure_firewall_threat_defense = 7.2.9`
- `secure_firewall_threat_defense = 7.2.10`
- `secure_firewall_threat_defense = 7.2.10.2`
- `secure_firewall_threat_defense = 7.3.0`
- `secure_firewall_threat_defense = 7.3.1`
- `secure_firewall_threat_defense = 7.3.1.1`
- `secure_firewall_threat_defense = 7.3.1.2`
- `secure_firewall_threat_defense = 7.4.0`
- `secure_firewall_threat_defense = 7.4.1`
- `secure_firewall_threat_defense = 7.4.1.1`
- `secure_firewall_threat_defense = 7.4.2`
- `secure_firewall_threat_defense = 7.4.2.1`
- `secure_firewall_threat_defense = 7.4.2.2`
- `secure_firewall_threat_defense = 7.4.2.3`
- `secure_firewall_threat_defense = 7.4.2.4`
- `secure_firewall_threat_defense = 7.6.0`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.2.1r`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.2`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.3`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.5`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.6`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.7`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1b`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.2`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.2`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.4`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.5`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.7`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.2`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.8.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.2a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5e`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5f`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7b`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.8`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.10.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.11.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a`
- `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4`

## Remediation

Upgrade past the affected range:

- `snort 3.6.3.0`