CVE-2026-121944 sngrep through 1.9.0 Infinite Loop DoS via Crafted NFLOG TLV

Medium 6.8 Published 4 Nov 2026 Updated 4 Nov 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-121944?

CVE-2026-121944 is a medium-severity vulnerability in irontec sngrep, published on 4 Nov 2026.

Official description

sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows attackers to cause denial of service via crafted NFLOG TLVs. Attackers can supply a pcap file with link type NFLOG containing a non-payload TLV with length under 4, making the capture thread spin at full CPU and stop processing packets.

Weakness: CWE-835

Which versions are affected by CVE-2026-121944?

How do I fix CVE-2026-121944?

No fix has been published for CVE-2026-121944 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-121944 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-121944 exists.

Sources

Also known as DEBIAN-CVE-2026-121944, GHSA-5wr4-785p-23qx, UBUNTU-CVE-2026-121944.