The flaw occurs in the logic handling of GPRS Tunneling Protocol extension headers within the Snort 3 codec. When a crafted, fragmented UDP datagram containing these headers is processed, the detection engine can enter an infinite loop that causes it to restart unexpectedly. This results in a denial of service condition for the system or network service that relies on the Snort 3 detection engine.

Affected vendors include Cisco, with the specific products Cisco Open Source Snort3, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco UTD SNORT IPS Engine Software. Version information is not provided in the advisory, so any installation of these products may be at risk until a patch is applied.

The CVSS score of 5.3 indicates a moderate severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying no publicly reported exploits as of the advisory. The attack vector is remote and unauthenticated; an attacker must send a crafted UDP packet to the Snort 3 detection engine. While the risk of a successful exploit is uncertain without EPSS data, the potential impact of a DoS condition should be considered significant for high‑availability environments.