PatchTheCVECVE-2009-3641: Snort before 2.8.5.1, when the -v option is enabled, allows remote attackers to cause a denial of service (app
CVE-2009-3641 is a medium-severity flaw (CVSS 4.3) affecting snort. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Snort before 2.8.5.1, when the -v option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted IPv6 packet that uses the (1) TCP or (2) ICMP protocol.
Why this priority
- EPSS top 1%: very likely to be exploited
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| EPSS exploit chance | 38.8% (top 1%) |
| CISA exploited list | No |
| Published | 2009-10-28 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: Snort 2.8.5 - Multiple Denial of Service Vulnerabilities
- Exploit-DB: Snort 2.8.5 - IPv6 Denial of Service
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2009-3641?
snort: upgrade to newer than 2.8.3.5. Exact commands for each OS are on this page.
Is CVE-2009-3641 being exploited?
CVE-2009-3641 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2009-3641 affect?
CVE-2009-3641 affects snort. Severity is medium (CVSS 4.3). Snort before 2.8.5.1, when the -v option is enabled, allows remote attackers to cause a denial of service (application crash) via a crafted IPv6 packet that uses the (1) TCP or (2) ICMP protocol.
How urgent is CVE-2009-3641?
Priority 45/100. EPSS top 1%: very likely to be exploited; Public exploit reference
Software pages
Suricata and Snort vulnerabilities
Related CVEs
- CVE-2025-20359 MEDIUM 6.5 UPGRADE Multiple Cisco products are affected by a vulnerability in the Snort 3 HTTP Decoder that could allow an unauth
- CVE-2000-1226 MEDIUM 5.0 DOWNGRADE Snort 1.6, when running in straight ASCII packet logging mode or IDS mode with straight decoded ASCII packet l
- CVE-2026-20005 MEDIUM 5.8 DOWNGRADE DOWNGRADE Multiple Cisco products are affected by a vulnerability in the Snort 3 Detection Engine that could allow an un
- CVE-2026-20053 MEDIUM 5.8 UPGRADE DOWNGRADE Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthe
- CVE-2026-20054 MEDIUM 5.8 UPGRADE DOWNGRADE Multiple Cisco products are affected by a vulnerability in the Snort 3 VBA feature that could allow an unauthe