The vulnerability lies in the Snort 3 NetFlow Detection Engine’s incomplete error checking during parsing of UDP NetFlow packets. An unauthenticated, remote attacker can craft a single NetFlow packet that, when parsed by Snort 3, forces the Detection Engine to restart. The result is a denial‑of‑service condition that interrupts packet inspection, potentially disabling network security monitoring. The weakness is a classic loop or control‑flow error (CWE‑835).

Affected vendors include Cisco Open Source Snort3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD SNORT IPS Engine Software. The flaw resides in the NetFlow detection component of these products; no specific version numbers are listed in the advisory, so all releases that contain Snort 3 with the NetFlow engine are potentially impacted.

The CVSS score of 5.8 indicates a moderate severity, and the lack of an EPSS score means the current exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. An attacker could exploit it by remotely sending a crafted NetFlow packet over an established UDP connection to the Snort 3 engine; authentication is not required. Because the flaw causes a restart of the detection engine, the impact is localized to the affected device and the intersection of all traffic inspection functions that rely on it.