CVE-2026-20004 — Missing Reference to Active Allocated Resource in Cisco IOS XE Software
Severity
7.4HIGHNVD
EPSS
0.0%
top 91.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 25
Description
A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an affected device.
This vulnerability is due to improper management of memory resources during TLS connection setup. An attacker could exploit this vulnerability by repeatedly triggering the conditions that cause the memory increase. This could be done in a variety of ways, such as by repeatedly attempting Extensible Authentication Protocol (EAP) authe…
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:HExploitability: 2.8 | Impact: 4.0
Affected Packages1 packages
🔴Vulnerability Details
2CVEList▶
CVE-2026-20004: A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an af↗2026-03-25
GHSA▶
GHSA-xp4f-63f5-wmm9: A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an af↗2026-03-25