--- id: CVE-2026-20066 title: >- Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspect… summary: >- Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspect… severity: medium cvss: 5.8 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L' cwe: - CWE-400 vendor: cisco product: snort affected: - 'snort >= 3.0.0-233, < 3.9.7.0' - secure_firewall_threat_defense = 7.4.0 - secure_firewall_threat_defense = 7.4.1 - secure_firewall_threat_defense = 7.4.1.1 - secure_firewall_threat_defense = 7.4.2 - secure_firewall_threat_defense = 7.4.2.1 - secure_firewall_threat_defense = 7.4.2.2 - secure_firewall_threat_defense = 7.4.2.3 - secure_firewall_threat_defense = 7.4.2.4 - secure_firewall_threat_defense = 7.4.3 - secure_firewall_threat_defense = 7.6.0 - secure_firewall_threat_defense = 7.6.1 - secure_firewall_threat_defense = 7.6.2 - secure_firewall_threat_defense = 7.6.2.1 - secure_firewall_threat_defense = 7.7.0 - secure_firewall_threat_defense = 7.7.10 - secure_firewall_threat_defense = 7.7.10.1 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.2.1r - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.2 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.3 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.5 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.6 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.7 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1b - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.2 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.2 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.4 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.5 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.7 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.2 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.8.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.2a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5e - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5f - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7b - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.8 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.10.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.11.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5c - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5d - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.6 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.13.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.14.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2c - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4c - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.16.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.17.1 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1 - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1a - unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.2 patched: - snort 3.9.7.0 published: '2026-03-04' updated: '2026-08-19' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-20066' references: - url: >- https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-multi-dos-XFWkWSwz label: psirt@cisco.com tags: - nvd epss: 0.00454 epssPercentile: 0.36921 ingestedAt: '2026-08-20T17:59:04.317Z' --- ## Overview Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet inspection. This vulnerability is due to an error in the JSTokenizer normalization logic when the HTTP inspection normalizes JavaScript. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine restarts unexpectedly. JSTokenizer is not enabled by default. ## Affected - `snort >= 3.0.0-233, < 3.9.7.0` - `secure_firewall_threat_defense = 7.4.0` - `secure_firewall_threat_defense = 7.4.1` - `secure_firewall_threat_defense = 7.4.1.1` - `secure_firewall_threat_defense = 7.4.2` - `secure_firewall_threat_defense = 7.4.2.1` - `secure_firewall_threat_defense = 7.4.2.2` - `secure_firewall_threat_defense = 7.4.2.3` - `secure_firewall_threat_defense = 7.4.2.4` - `secure_firewall_threat_defense = 7.4.3` - `secure_firewall_threat_defense = 7.6.0` - `secure_firewall_threat_defense = 7.6.1` - `secure_firewall_threat_defense = 7.6.2` - `secure_firewall_threat_defense = 7.6.2.1` - `secure_firewall_threat_defense = 7.7.0` - `secure_firewall_threat_defense = 7.7.10` - `secure_firewall_threat_defense = 7.7.10.1` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.2.1r` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.2` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.3` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.4a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.5` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.6` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.7` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.3.8a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.1b` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.4.2` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.5.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.2` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.3a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.4` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.5` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.6a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.7` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.6.8a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.7.2` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.8.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.2a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.3a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.4a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5e` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.5f` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.6` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.7b` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.9.8` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.10.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.11.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.2` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.3a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.4b` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5b` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5c` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.5d` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.12.6` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.13.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.14.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.2c` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.3a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.15.4c` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.16.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.17.1` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.1a` - `unified_threat_defense_snort_intrusion_prevention_system_engine = 17.18.2` ## Remediation Upgrade past the affected range: - `snort 3.9.7.0`