PT-2026-2046 · Cisco+1 · Cisco Products+1
Guy Lederfein
·
Publicado
2026-01-07
·
Atualizado
2026-02-04
·
CVE-2026-20026
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Cisco Snort (affected versions not specified)
Description
A flaw exists in the processing of DCE/RPC requests that may allow a remote, unauthenticated attacker to cause the Snort 3 Detection Engine to leak sensitive information or restart, leading to a disruption of packet inspection. This issue is due to a buffer use-after-free read error in the buffer handling logic when processing DCE/RPC requests. An attacker could exploit this by sending a large number of DCE/RPC requests through an established connection inspected by Snort 3. A successful exploit could unexpectedly restart the Snort 3 Detection Engine, potentially causing a denial of service (DoS). The vulnerable component is the
bnfa search csparse nfa function.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Double Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Cisco Products
Snort 3 Detection Engine