CVE-2025-20359: Cisco Snort 3 buffer under-read in HTTP MIME decoder

CVE-2025-20359 · Severity: medium · CVSS 6.5 · Published 2025-10-15

Cisco Snort 3, a network intrusion detection engine used across multiple Cisco security products, contains a flaw in how it processes HTTP email-style headers (MIME fields). An attacker can send specially crafted network packets to trigger either a crash of the detection engine (denying its protective functions) or leak sensitive data from memory. This affects firewalls, routers, and security appliances that rely on Snort 3.

Technologies: Cisco Catalyst 8000V Edge Software, Cisco Catalyst 8200 Series Edge Platforms, Cisco Catalyst 8300 Series Edge Platforms, Cisco Catalyst 8500L Edge Platforms, Cisco Cloud Services Router 1000V, Cisco Cyber Vision, Cisco IOS XE, Cisco Meraki MX Series, Cisco Secure Firewall Threat Defense, Cisco Snort 3. Vendors: Cisco.

Quick answers

Is CVE-2025-20359 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-20359 being exploited in the wild.
How severe is CVE-2025-20359?
Medium severity, with a CVSS score of 6.5, published 15 October 2025.
Which products and versions are affected?
Cisco Catalyst 8000V Edge Software Releases with vulnerable UTD; Cisco Catalyst 8200 Series Edge Platforms Releases with vulnerable UTD; Cisco Catalyst 8300 Series Edge Platforms Releases with vulnerable UTD; Cisco Catalyst 8500L Edge Platforms Releases with vulnerable UTD; and 7 more.
Is there a fix for CVE-2025-20359?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-20359 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-20359?
Check whether you run Cisco Catalyst 8000V Edge Software, Cisco Catalyst 8200 Series Edge Platforms, Cisco Catalyst 8300 Series Edge Platforms or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a buffer under-read (CWE-127, CWE-805) in the Snort 3 HTTP MIME field parser logic. When processing MIME headers in HTTP traffic, improper buffer handling causes the decoder to read from invalid memory locations, resulting in either a crash (denial of service) or information disclosure of sensitive data in the network stream. An unauthenticated remote attacker can exploit this by sending crafted HTTP packets through an established connection monitored by Snort 3, with no authentication or special preconditions required. Cisco has released software updates to address the vulnerability; no workarounds are available.

Affected products

  • Cisco Snort 3 Multiple versions (see vendor advisory for specific ranges)
  • Cisco Secure Firewall Threat Defense 7.0.0 and later (when Snort 3 is configured)
  • Cisco IOS XE Releases with vulnerable Unified Threat Defense (UTD) Snort IPS Engine
  • Cisco Catalyst 8000V Edge Software Releases with vulnerable UTD
  • Cisco Catalyst 8200 Series Edge Platforms Releases with vulnerable UTD
  • Cisco Catalyst 8300 Series Edge Platforms Releases with vulnerable UTD
  • Cisco Catalyst 8500L Edge Platforms Releases with vulnerable UTD
  • Cisco Cloud Services Router 1000V Releases with vulnerable UTD
  • Cisco Integrated Services Virtual Router Releases with vulnerable UTD
  • Cisco Meraki MX Series Multiple MX models with vulnerable Meraki software releases
  • Cisco Cyber Vision Vulnerable releases

Timeline

  • 2025-10-15: disclosed: Cisco Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.