CVE-2025-20359 is a medium severity (6.5) buffer under-read in the Snort 3 HTTP decoder. An unauthenticated remote attacker could cause the engine to restart or return sensitive data. For open source Snort 3, Cisco lists 3.9.3.0 as the first fixed release, and Cisco products have their own fixes.
What's affected
Cisco's advisory, first published 15 October 2025 and revised on 12 February 2026 for Meraki fixes, covers two vulnerabilities in the HTTP MIME decoder. This one is the buffer handling error when MIME fields of the HTTP header are parsed. The weakness is CWE-127, buffer under-read.
The affected products listed are open source Snort 3, Cisco Secure Firewall Threat Defense software when Snort 3 is configured, Cisco IOS XE devices running the Unified Threat Defense engine, and certain Cisco Meraki MX appliances. On new Secure FTD installations of release 7.0.0 and later, Snort 3 runs by default. Devices that began on 6.7.0 or earlier and were upgraded keep Snort 2 by default, and Snort 2 is not affected.
On IOS XE, the affected models include the 1000 and 4000 Series ISRs, Catalyst 8000V, 8200, 8300 and 8500L edge platforms, and the Cloud Services Router 1000V, and only if the UTD package is installed.
Cisco says its Product Security Incident Response Team is not aware of public announcements or malicious use. The record is not on the CISA Known Exploited Vulnerabilities list.
Fixed versions: for open source Snort 3, the advisory table gives 3.9.3.0 as the first fixed release for this CVE, and 3.9.1.0 for the companion CVE-2025-20360. For Cisco products, use the Cisco Software Checker and the bug IDs.
How to check if you're exposed
For open source Snort, print the version.
snort -V
For IOS XE, Cisco gives this check for UTD. If the output shows Yes under Running, it is enabled. No output means the device is not affected.
show utd engine standard status
For Secure FTD, see Cisco's guidance on determining the active Snort version, and confirm whether Snort 3 is in use. Snort 3 must be active for the flaw to apply. For Meraki MX, check the firmware against the fixed releases in the advisory.
What to do now
- List every place Snort 3 runs, including open source sensors, FTD devices, IOS XE routers with UTD and Meraki MX appliances.
- Upgrade open source Snort 3 to 3.9.3.0 or later.
- For Cisco products, run each release through the Cisco Software Checker and install the first fixed release it gives.
- There are no workarounds, so schedule the upgrade, and watch for unexpected Snort engine restarts in the meantime.
- Confirm that traffic is still inspected after a restart. A crashing engine can leave a gap in coverage.
- Remove the UTD package from routers that do not use it.
- Track Snort as part of your dependency inventory.
Why it matters
A buffer under-read means the code reads memory before the start of a buffer. Two outcomes are described. The engine can restart, which is a denial of service, and in an inspection engine that may mean traffic goes uninspected or is dropped during the restart. Or it can return data that is not valid connection data, which is memory content that should not leave the process.
The parser is the point where untrusted network input meets complex code. Snort reads traffic from many sources by design, so its parsers must be strict. Keeping the engine current is a routine task that is easy to miss on embedded copies inside firewalls and routers, which is why an inventory matters.
Quick check
Is Snort 2 affected?
According to the advisory, Snort 3 must be active for the vulnerabilities to be exploited. Check which Snort version your device runs.
Which open source Snort version fixes this?
The advisory lists 3.9.3.0 as the first fixed release for this CVE. Use that or a newer release.
Sources
Last reviewed: 19 October 2026.
