CVE-2026-121944
MediumCVSS 5.5Summary
sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, causing the capture thread to spin at full CPU and stop processing packets.
Risk Assessment
An attacker could cause a denial of service by making sngrep stop processing packets.
Recommendation
Update sngrep to a version later than 1.9.0 that fixes the infinite loop vulnerability.
Other vulnerabilities in sngrep
See all- CVE-2026-121943Medium
Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and sip_validate_packet caused by an off-by-one length check on 10240-byte SIP payloads. Remote attackers can send a crafted UDP or TCP SIP packet or supply a pcap file to crash sngrep or leak adjacent stack bytes into displayed SIP fields.
- CVE-2026-90558Critical
sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-byte buffer limit. Attackers can craft malicious SIP packets with oversized Call-ID, X-Call-ID, or other header fields to overflow stack buffers and cause crashes or execute arbitrary code during packet parsing and rendering.
- CVE-2023-36192High
Sngrep v1.6.0 was discovered to contain a heap buffer overflow via the function capture_ws_check_packet at /src/capture.c.
Original NVD description (English source)
sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, making the capture thread spin at full CPU and stop processing packets.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS