CVE-2021-1224
MediumCVSS 5.8Exploitation Probability (EPSS)
High risk79th percentile - higher than 79% of all known CVEs
Summary
A vulnerability with TCP Fast Open (TFO) when used with the Snort detection engine in multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The issue is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could send crafted TFO packets with an HTTP payload through an affected device, potentially bypassing the policy and delivering a malicious payload.
Risk Assessment
The risk is that an attacker can bypass file policy and deliver malware to the protected network.
Recommendation
It is recommended to upgrade to a patched version and consider disabling TFO if not required.
Other vulnerabilities in Snort
See all- CVE-2016-1417High
The vulnerability in Snort 2.9.7.0-WIN32 related to an untrusted search path allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a malicious tcapi.dll file located in the same folder as a processed pcap file.
- CVE-2026-20043Critical
A vulnerability in Cisco Snort 3 software related to out-of-bounds writes (CWE-787). It was discovered during an internal security review and fixed in hardening releases.
- CVE-2026-76524High
The Snort 3 control channel socket implementation lacks authentication when a local user connects to the socket. An authenticated local attacker with low privileges can execute arbitrary commands as the Snort 3 process user and read or write the process memory.
- CVE-2026-76489Medium
Multiple Cisco products are affected by a vulnerability in the memory management implementation of Snort 3 that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The issue is due to incomplete error checking when Snort 3 processes files, which could cause unreleased memory.
- CVE-2026-20356High
Cisco Snort 3 contains multiple internally discovered vulnerabilities related to uncontrolled resource consumption (CWE-400) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.
- CVE-2026-20291High
Cisco's Open Source Snort 3 software engineering team conducted an internal security review, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20291 relate to improper privilege management (CWE-269).
- CVE-2026-20236High
Cisco Snort 3 contains multiple internally discovered vulnerabilities related to incorrect calculation (CWE-682) that have been addressed in software hardening releases. Technical details of individual cases were not disclosed in the description.
- CVE-2026-20218Medium
A vulnerability in the Snort 3 VBA Decompression Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting in a denial of service (DoS). The flaw is due to improper range checking when decompressing user-controlled VBA data. Sending crafted VBA data can cause a stack overflow and DoS condition.
- CVE-2026-20197Medium
A vulnerability in the Snort 3 Teredo Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing Teredo packets. Sending a crafted Teredo packet to a targeted device can cause an unexpected restart and DoS condition.
- CVE-2026-20179Medium
A vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine of multiple Cisco products allows an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, interrupting packet inspection. The flaw is due to incomplete error checking when parsing GRE packets. Sending a crafted GRE packet to a targeted device can cause an unexpected restart and DoS condition.
Original NVD description (English source)
Multiple Cisco products are affected by a vulnerability with TCP Fast Open (TFO) when used in conjunction with the Snort detection engine that could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The vulnerability is due to incorrect detection of the HTTP payload if it is contained at least partially within the TFO connection handshake. An attacker could exploit this vulnerability by sending crafted TFO packets with an HTTP payload through an affected device. A successful exploit could allow the attacker to bypass configured file policy for HTTP packets and deliver a malicious payload.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS