Cisco patches multiple Snort 3 DoS flaws
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
Cisco fixed 13 vulnerabilities in Snort 3's detection engine allowing unauthenticated remote DoS and local privilege escalation to command execution.
NCSC-NL published an advisory summarizing 13 CVEs that Cisco has patched in Snort 3, the open-source IDS/IPS engine embedded in multiple Cisco security products. The flaws span several detection engine components including the SMTP MIME decoder, NetFlow, GRE, Teredo, and VBA decompression engines, as well as general memory management. Most of the vulnerabilities (stack-based buffer overflow, NULL pointer dereference, out-of-bounds write, wrap-around errors, infinite loops) allow an unauthenticated remote attacker to send specially crafted packets or datagrams that crash the detection engine, causing a denial of service and a corresponding gap in traffic inspection and threat detection.
One notable flaw involves missing authentication on the Snort 3 control channel socket, which could allow a low-privileged, authenticated local attacker to execute arbitrary commands and access the Snort 3 process memory. The highest-rated issue, CVE-2026-20043, carries a CVSS score of 9.0. Cisco has released software updates and hardening guidance across six separate security advisories referenced in the bulletin; there is no indication in this advisory of active exploitation in the wild. Defenders running Cisco products that embed Snort 3 should prioritize patching per Cisco's linked advisories, particularly for internet-facing or untrusted-traffic-exposed deployments where the DoS vectors are most impactful.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0450.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,932 reports from 143 sources, 508 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs