CVE-2026-121944
Deferred Deferred - Pending Action

Infinite Loop in sngrep via Malformed NFLOG TLV

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, making the capture thread spin at full CPU and stop processing packets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-121944
EUVD
EUVD-2026-116901

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
irontec sngrep 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121944 is an infinite loop vulnerability in sngrep through version 1.9.0. It occurs in the capture_packet_reasm_ip() function in src/capture.c when processing NFLOG TLVs. Attackers can exploit this by providing a crafted pcap file with a non-payload TLV of length under 4, causing the capture thread to spin at full CPU usage and stop processing packets.

Detection Guidance

To detect this vulnerability, monitor for high CPU usage by sngrep processes, which may indicate an infinite loop. Check if sngrep is processing pcap files with NFLOG link type containing malformed TLVs. Use tools like top or htop to observe CPU spikes during packet capture.

Impact Analysis

This vulnerability can lead to a denial of service (DoS) where the sngrep application becomes unresponsive or freezes the system. It consumes 100% CPU, halting packet processing and potentially making the system unusable until the process is terminated.

Mitigation Strategies

Immediately update sngrep to the latest version beyond 1.9.0. If updating is not possible, disable sngrep's NFLOG link-layer processing or restrict its access to untrusted pcap files. Monitor network traffic for suspicious patterns and block malformed packets at the firewall level.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121944. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...