CVE-2025-20359

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-20359
Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the disclosure of possible sensitive data or cause the Snort 3 Detection Engine to crash. This vulnerability is due to an error in the logic of buffer handling when the MIME fields of the HTTP header are parsed. This can result in a buffer under-read. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection that is parsed by Snort 3. A successful exploit could allow the attacker to induce one of two possible outcomes: the unexpected restarting of the Snort 3 Detection Engine, which could cause a denial of service (DoS) condition, or information disclosure of sensitive information in the Snort 3 data stream. Due to the under-read condition, it is possible that sensitive information that is not valid connection data could be returned.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:snort:*:*:*:*:*:*:*:*
History

18 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) Múltiples productos Cisco se ven afectados por una vulnerabilidad en el decodificador HTTP de Snort 3 que podría permitir a un atacante remoto no autenticado causar la revelación de posibles datos sensibles o provocar la caída del motor de detección de Snort 3. Esta vulnerabilidad se debe a un error en la lógica del manejo de búferes cuando se analizan los campos MIME del encabezado HTTP. Esto puede resultar en una lectura insuficiente del búfer. Un atacante podría explotar esta vulnerabilidad enviando paquetes HTTP manipulados a través de una conexión establecida que es analizada por Snort 3. Un exploit exitoso podría permitir al atacante inducir uno de dos posibles resultados: el reinicio inesperado del motor de detección de Snort 3, lo que podría causar una condición de denegación de servicio (DoS), o la revelación de información sensible en el flujo de datos de Snort 3. Debido a la condición de lectura insuficiente, es posible que se devuelva información sensible que no sea datos de conexión válidos.

17 Sep 2026, 19:25

Type Values Removed Values Added
References () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH - () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-snort3-mime-vulns-tTL8PgVH - Vendor Advisory
CPE cpe:2.3:a:cisco:snort:*:*:*:*:*:*:*:*
First Time Cisco snort
Cisco
Information

Published : 2025-10-15 17:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-20359

Mitre link : CVE-2025-20359

CVE.ORG link : CVE-2025-20359

JSON object : View

Products Affected

cisco

  • snort
CWE
CWE-127

Buffer Under-read