Cisco Snort 3 HTTP Decoder DoS via Unchecked MIME Header Parsing
CVE-2025-20360 Published on October 15, 2025

Multiple Cisco Products Snort 3 MIME Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a lack of complete error checking when the MIME fields of the HTTP header are parsed. An attacker could exploit this vulnerability by sending crafted HTTP packets through an established connection to be parsed by Snort 3. A successful exploit could allow the attacker to cause a DoS condition when the Snort 3 Detection Engine unexpectedly restarts.

NVD

Vulnerability Analysis

CVE-2025-20360 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
LOW

Weakness Type

Buffer Access with Incorrect Length Value

The software uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer. When the length value exceeds the size of the destination, a buffer overflow could occur.


Products Associated with CVE-2025-20360

Want to know whenever a new CVE is published for Cisco Cyber Vision? stack.watch will email you.

Cisco Cyber Vision
 

Affected Versions

Cisco Cyber Vision: Cisco Secure Firewall Threat Defense (FTD) Software:

Exploit Probability

EPSS
0.16%
Percentile
36.89%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.