Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine.
This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required.
Metrics
Affected Vendors & Products
References
History
Fri, 23 Oct 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cisco
Cisco cisco Open Source Snort3 Cisco cisco Secure Firewall Threat Defense (ftd) Software Cisco cisco Utd Snort Ips Engine Software Cisco cyber Vision Cisco secure Firewall Threat Defense Cisco umbrella Insights Virtual Appliance |
|
| Vendors & Products |
Cisco
Cisco cisco Open Source Snort3 Cisco cisco Secure Firewall Threat Defense (ftd) Software Cisco cisco Utd Snort Ips Engine Software Cisco cyber Vision Cisco secure Firewall Threat Defense Cisco umbrella Insights Virtual Appliance |
Thu, 22 Oct 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 21 Oct 2026 17:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected restart of the Snort 3 Detection Engine. This vulnerability is due to improper handling of nested GRE traffic. An attacker could exploit this vulnerability by sending a crafted GRE payload through an affected device. A successful exploit could allow the attacker to trigger an unexpected reload of the Snort 3 Detection Engine, resulting in either a bypass or denial of service (DoS) condition, depending on device configuration. For more information, see the section of this advisory. The Snort 3 Detection Engine will restart automatically. No manual intervention is required. | |
| Title | Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities | |
| Weaknesses | CWE-476 | |
| References |
| |
| Metrics |
cvssV3_1
|
Status: PUBLISHED
Assigner: cisco
Published: 2026-10-21T16:12:53.435Z
Updated: 2026-10-22T19:11:26.546Z
Reserved: 2025-10-08T11:59:15.398Z
Link: CVE-2026-20221
Updated: 2026-10-22T13:36:52.741Z
Status : Awaiting Analysis
Published: 2026-10-21T17:18:27.947
Modified: 2026-10-22T14:17:40.940
Link: CVE-2026-20221
No data.