CVE-2026-20004
A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resources during TLS connection setup. An attacker could exploit this vulnerability by repeatedly triggering the conditions that cause the memory increase. This could be done in a variety of ways, such as by repeatedly attempting Extensible Authentication Protocol (EAP) authentication when local EAP is enabled on an affected device or by using a machine-in-the-middle attack and resetting TLS connections between the affected device and other devices. A successful exploit could allow the attacker to exhaust the available memory on an affected device, resulting in an unexpected reload and a denial of service (DoS) condition.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.4
- CVSS vector
- CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
- EPSS probability
- 0.18%
- CWE
- CWE-771
- Published
- 2026-03-25
- Last modified
- 2026-03-26
Affected products
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
- Cisco Cisco IOS XE Software
Weakness type
Related vulnerabilities
- CVE-2026-3039 — BIND 9 server memory exhaustion during GSS-API TKEY negotiation
- CVE-2025-21090 — Missing reference to active allocated resource for some Intel(R) Xeon(R) processors may allow an...
- CVE-2024-56343 — IBM Verify Identity Access Digital Credentials denial of service
- CVE-2023-20244 — A vulnerability in the internal packet processing of Cisco Firepower Threat Defense (FTD) Software...
- CVE-2021-34720 — Cisco IOS XR Software IP Service Level Agreements and Two-Way Active Measurement Protocol Denial of Service Vulnerability