This vulnerability arises from incomplete error checking when Snort 3 parses Multicast DNS fields in HTTP headers. An unauthenticated, remote attacker can send crafted HTTP packets that, when processed by Snort 3, cause the detection engine to restart, interrupting packet inspection and causing a denial‑of‑service condition.

The flaw affects several Cisco products, including Cisco Cyber Vision, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD SNORT IPS Engine Software. No specific version ranges are provided in the advisory, so all deployed instances that incorporate the vulnerable Snort 3 engine should be considered potentially impacted.

The CVSS score of 5.8 indicates moderate severity, and the EPSS score of less than 1% reflects a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers require no authentication and can exploit the flaw remotely by sending malicious HTTP traffic, making it straightforward to trigger an engine restart. While the probability of an attack is low, the impact of a service interruption on high‑availability or critical network infrastructure can be significant, so timely remediation is advisable.