CVE-2026-121944

MEDIUM 5.5

sngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLV

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, making the capture thread spin at full CPU and stop processing packets.

CWE	CWE-835
Vendor	irontec
Product	sngrep
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for irontec sngrep

Be the first to know when new medium vulnerabilities affecting irontec sngrep are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

irontec / sngrep

0 ≤ 1.9.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/irontec/sngrep/issues/589 hackmd.io: https://hackmd.io/@haindpwn/sngrep-sip-payload-missing-nul-oob-read github.com: https://github.com/irontec/sngrep/blob/v1.9.0/src/capture.c#L581-L598 vulncheck.com: https://www.vulncheck.com/advisories/sngrep-through-1.9.0-infinite-loop-dos-via-crafted-nflog-tlv

Credits

HaiND from the Post and Telecommunication Institute of Technology