CVE-2020-3299
MediumCVSS 5.8Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A vulnerability in the Snort detection engine of multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The issue is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could send crafted HTTP packets through an affected device, potentially bypassing the policy and delivering a malicious payload.
Risk Assessment
The risk is that an attacker can bypass security policies and deliver malware to the protected network.
Recommendation
It is recommended to upgrade to a patched version and review file policy configurations.
Other vulnerabilities in Snort
See all- CVE-2016-1417High
The vulnerability in Snort 2.9.7.0-WIN32 related to an untrusted search path allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a malicious tcapi.dll file located in the same folder as a processed pcap file.
- CVE-2026-20043Critical
A vulnerability in Cisco Snort 3 software related to out-of-bounds writes (CWE-787). It was discovered during an internal security review and fixed in hardening releases.
- CVE-2026-76524High
The Snort 3 control channel socket implementation lacks authentication when a local user connects to the socket. An authenticated local attacker with low privileges can execute arbitrary commands as the Snort 3 process user and read or write the process memory.
- CVE-2026-76489Medium
Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The issue is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory.
- CVE-2026-20356High
Cisco Snort 3 contains multiple internally discovered vulnerabilities related to uncontrolled resource consumption (CWE-400) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.
- CVE-2026-20291High
Cisco's Open Source Snort 3 software engineering team conducted an internal security review, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20291 relate to improper privilege management (CWE-269).
- CVE-2026-20236High
Cisco Snort 3 contains multiple internally discovered vulnerabilities related to incorrect calculation (CWE-682) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.
- CVE-2026-20218Medium
A vulnerability in the Snort 3 VBA Decompression Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS). The flaw is due to improper range checking when decompressing user-controlled VBA data. Sending crafted VBA data can cause a stack overflow and DoS condition.
- CVE-2026-20197Medium
A vulnerability in the Snort 3 Teredo Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing Teredo packets. Sending a crafted Teredo packet to a targeted device can cause an unexpected restart and DoS condition.
- CVE-2026-20179Medium
A vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing GRE packets. Sending a crafted GRE packet to a targeted device can cause an unexpected restart and DoS condition.
Original NVD description (English source)
Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured File Policy for HTTP. The vulnerability is due to incorrect detection of modified HTTP packets used in chunked responses. An attacker could exploit this vulnerability by sending crafted HTTP packets through an affected device. A successful exploit could allow the attacker to bypass a configured File Policy for HTTP packets and deliver a malicious payload.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS