sngrep up to version 1.9.0 contains an infinite loop in capture_packet_reasm_ip(), which can be triggered by feeding a pcap file that contains NFLOG TLVs with a non‑payload TLV length shorter than four bytes. The loop consumes the CPU continuously, halting normal packet processing and effectively denying service to any process or system that relies on sngrep for monitoring or diagnostics. This weakness is classified as CWE-835, reflecting improper loop control that leads to resource exhaustion.

Irontec sngrep, any distribution or environment using sngrep 1.9.0 or earlier, regardless of operating system, is susceptible. The vulnerability arises whenever the NFLOG link type is processed by sngrep; therefore any installation that enables NFLOG capture is at risk.

The CVSS score of 6.8 indicates a medium severity. EPSS is not available and the issue is not listed in the CISA KEV catalog, suggesting low publicly reported exploitation but the attack remains feasible. The likely attack vector is local—an attacker who can supply a custom pcap file to sngrep, or who can control the sngrep process, can immediately trigger the loop. Exploitation requires no network connectivity beyond the ability to invoke sngrep with a crafted file, and causes the capture thread to spin at full CPU, bringing system resources to a halt.