CVE-2026-20021
Memory Exhaustion in Cisco ASA/FTD OSPF Causes DoS
Publication date: 2026-03-04
Last updated on: 2026-04-16
Assigner: Cisco Systems, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cisco | adaptive_security_appliance_software | From 9.12.1 (inc) to 9.12.4.67 (inc) |
| cisco | adaptive_security_appliance_software | From 9.16.1 (inc) to 9.16.4.85 (inc) |
| cisco | adaptive_security_appliance_software | From 9.17.1 (inc) to 9.17.1.46 (inc) |
| cisco | adaptive_security_appliance_software | From 9.18.1 (inc) to 9.18.4.68 (inc) |
| cisco | adaptive_security_appliance_software | From 9.19.1 (inc) to 9.19.1.42 (inc) |
| cisco | adaptive_security_appliance_software | From 9.20.1 (inc) to 9.20.4.14 (inc) |
| cisco | adaptive_security_appliance_software | From 9.22.1.1 (inc) to 9.22.2.14 (inc) |
| cisco | adaptive_security_appliance_software | From 9.23.1 (inc) to 9.23.1.22 (inc) |
| cisco | firepower_threat_defense_software | 6.4.0 |
| cisco | firepower_threat_defense_software | 6.4.0.1 |
| cisco | firepower_threat_defense_software | 6.4.0.3 |
| cisco | firepower_threat_defense_software | 6.4.0.2 |
| cisco | firepower_threat_defense_software | 6.4.0.4 |
| cisco | firepower_threat_defense_software | 6.4.0.5 |
| cisco | firepower_threat_defense_software | 6.4.0.6 |
| cisco | firepower_threat_defense_software | 6.4.0.7 |
| cisco | firepower_threat_defense_software | 6.4.0.8 |
| cisco | firepower_threat_defense_software | 6.4.0.9 |
| cisco | firepower_threat_defense_software | 6.4.0.10 |
| cisco | firepower_threat_defense_software | 6.4.0.11 |
| cisco | firepower_threat_defense_software | 6.4.0.12 |
| cisco | firepower_threat_defense_software | 6.4.0.13 |
| cisco | firepower_threat_defense_software | 6.4.0.14 |
| cisco | firepower_threat_defense_software | 6.4.0.15 |
| cisco | firepower_threat_defense_software | 6.4.0.16 |
| cisco | firepower_threat_defense_software | 6.4.0.17 |
| cisco | firepower_threat_defense_software | 7.0.0 |
| cisco | firepower_threat_defense_software | 7.0.0.1 |
| cisco | firepower_threat_defense_software | 7.0.1 |
| cisco | firepower_threat_defense_software | 7.0.1.1 |
| cisco | firepower_threat_defense_software | 7.0.2 |
| cisco | firepower_threat_defense_software | 7.0.2.1 |
| cisco | firepower_threat_defense_software | 7.0.3 |
| cisco | firepower_threat_defense_software | 7.0.4 |
| cisco | firepower_threat_defense_software | 7.0.5 |
| cisco | firepower_threat_defense_software | 7.0.6 |
| cisco | firepower_threat_defense_software | 7.0.6.1 |
| cisco | firepower_threat_defense_software | 7.1.0 |
| cisco | firepower_threat_defense_software | 7.1.0.1 |
| cisco | firepower_threat_defense_software | 7.1.0.2 |
| cisco | firepower_threat_defense_software | 7.1.0.3 |
| cisco | firepower_threat_defense_software | 7.2.0 |
| cisco | firepower_threat_defense_software | 7.2.0.1 |
| cisco | firepower_threat_defense_software | 7.2.1 |
| cisco | firepower_threat_defense_software | 7.2.2 |
| cisco | firepower_threat_defense_software | 7.2.3 |
| cisco | firepower_threat_defense_software | 7.2.4 |
| cisco | firepower_threat_defense_software | 7.2.4.1 |
| cisco | firepower_threat_defense_software | 7.2.5 |
| cisco | firepower_threat_defense_software | 7.2.5.1 |
| cisco | firepower_threat_defense_software | 7.3.0 |
| cisco | firepower_threat_defense_software | 7.3.1 |
| cisco | firepower_threat_defense_software | 7.3.1.1 |
| cisco | firepower_threat_defense_software | 7.4.0 |
| cisco | firepower_threat_defense_software | 7.4.1 |
| cisco | firepower_threat_defense_software | 7.4.1.1 |
| cisco | firepower_threat_defense_software | 7.3.1.2 |
| cisco | firepower_threat_defense_software | 7.2.8.1 |
| cisco | firepower_threat_defense_software | 7.2.8 |
| cisco | firepower_threat_defense_software | 7.2.5.2 |
| cisco | firepower_threat_defense_software | 7.2.7 |
| cisco | firepower_threat_defense_software | 7.2.6 |
| cisco | firepower_threat_defense_software | 7.0.6.2 |
| cisco | firepower_threat_defense_software | 6.4.0.18 |
| cisco | firepower_threat_defense_software | 7.4.2 |
| cisco | firepower_threat_defense_software | 7.0.6.3 |
| cisco | firepower_threat_defense_software | 7.0.7 |
| cisco | firepower_threat_defense_software | 7.0.8 |
| cisco | firepower_threat_defense_software | 7.0.8.1 |
| cisco | firepower_threat_defense_software | 7.2.9 |
| cisco | firepower_threat_defense_software | 7.4.2.1 |
| cisco | firepower_threat_defense_software | 7.4.2.2 |
| cisco | firepower_threat_defense_software | 7.4.2.3 |
| cisco | firepower_threat_defense_software | 7.4.2.4 |
| cisco | firepower_threat_defense_software | 7.6.0 |
| cisco | firepower_threat_defense_software | 7.7.0 |
| cisco | firepower_threat_defense_software | 7.2.10 |
| cisco | firepower_threat_defense_software | 7.2.10.2 |
| cisco | firepower_threat_defense_software | 7.6.1 |
| cisco | firepower_threat_defense_software | 7.6.2 |
| cisco | firepower_threat_defense_software | 7.6.2.1 |
| cisco | firepower_threat_defense_software | 7.7.10 |
| cisco | firepower_threat_defense_software | 7.7.10.1 |
| cisco | firepower_threat_defense_software | 7.4.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-20021 is a vulnerability in the OSPF protocol implementation of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software. It occurs because the software does not properly validate input when parsing OSPF packets.
An attacker who is adjacent on the network can send specially crafted OSPF packets to the affected device. This causes the device to exhaust its memory, which can lead to a denial of service (DoS) condition such as device reloads or crashes.
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': "This vulnerability can impact you by causing a denial of service (DoS) on your Cisco Secure Firewall ASA or FTD devices running OSPF. An attacker can exhaust the device's memory by sending crafted OSPF packets, which may cause the device to reload or crash."}, {'type': 'paragraph', 'content': 'Such a DoS condition can disrupt network security and connectivity, potentially leading to downtime or loss of protection provided by the firewall.'}] [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
There are no workarounds available for this vulnerability. Cisco strongly recommends upgrading to fixed software releases to fully remediate the issue.
Immediate mitigation involves applying the software updates provided by Cisco for the Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software that address this OSPF protocol vulnerability.