CoreCVE
Back

HIGH

A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an affected device

Published Mar 25, 2026

Description

A vulnerability in the TLS library of Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to exhaust the available memory of an affected device. This vulnerability is due to improper management of memory resources during TLS connection setup. An attacker could exploit this vulnerability by repeatedly triggering the conditions that cause the memory increase. This could be done in a variety of ways, such as by repeatedly attempting Extensible Authentication Protocol (EAP) authentication when local EAP is enabled on an affected device or by using a machine-in-the-middle attack and resetting TLS connections between the affected device and other devices. A successful exploit could allow the attacker to exhaust the available memory on an affected device, resulting in an unexpected reload and a denial of service (DoS) condition.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (1)

CWE-771

References (1)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner cisco
Published Mar 25, 2026
Updated Mar 26, 2026
Reserved Oct 8, 2025
Link CVE-2026-20004
CISA Vulnrichment
Updated Mar 26, 2026
NVD
Status Awaiting Analysis
Modified Jun 17, 2026
Link CVE-2026-20004
Red Hat
Severity n/a
Public date n/a
Links CVE-2026-20004