PT-2025-42381 · Cisco · Cisco Snort 3

Published 2025-10-15 · Updated 2026-02-23 · CVE-2025-20359

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco Snort 3 (affected versions not specified)

Description A flaw exists in the Snort 3 HTTP Decoder that may allow a remote attacker to disclose sensitive data or cause the Snort 3 Detection Engine to crash. This issue stems from an error in buffer handling during the parsing of HTTP header MIME fields, leading to a buffer under-read. An attacker could exploit this by sending specially crafted HTTP packets through an established connection. A successful exploit could result in a denial of service (DoS) condition due to the unexpected restarting of the Snort 3 Detection Engine, or the disclosure of sensitive information within the Snort 3 data stream.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-127

Related Identifiers

CVE-2025-20359

ZDI-25-966

Affected Products

Cisco Snort 3

References · 8

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20359 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-25-966 · Security Note
• https://t.me/CVEtracker/35025 · Telegram Post
• https://twitter.com/0dayPublishing/status/1978513527322145201 · Twitter Post
• https://twitter.com/CVEnew/status/1978545035777130645 · Twitter Post
• https://twitter.com/probablypwned/status/2025979258082906219 · Twitter Post
• https://twitter.com/SystemTek_UK/status/1979276337513648231 · Twitter Post