The DecodeTCPOptions function in decode.c in Snort before 2.3.0, when printing TCP/IP options using FAST output or verbose mode, allows rem…

1. 2004-12-22 First public exploit (EDB-25047)
2. 2004-12-31 Published

11.19% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

• EDB-25047 Snort 2.1/2.2 - DecodeTCPOptions Remote Denial of Service (2) dos, 2004-12-22
• EDB-25046 Snort 2.1/2.2 - DecodeTCPOptions Remote Denial of Service (1) dos, 2004-12-22
• securitytracker.com http://securitytracker.com/id?1012656 referenced PoC, tagged "exploit" by a source, unverified
• securityfocus.com http://www.securityfocus.com/bid/12084 referenced PoC, tagged "exploit" by a source, unverified
• securiteam.com http://www.securiteam.com/exploits/6X00L20C0S.html referenced PoC, tagged "exploit" by a source, unverified
• osvdb.org http://www.osvdb.org/12578 referenced PoC, tagged "exploit" by a source, unverified
• taosecurity.blogspot.com http://taosecurity.blogspot.com/2004/12/details-on-snort-dos-condition-you-may.html referenced PoC, tagged "exploit" by a source, unverified

• securitytracker.com /id?1012656

  vdb-entry, exploit, patch

• secunia.com /advisories/13664

  third-party-advisory, patch, vendor-advisory

• securityfocus.com /bid/12084

  vdb-entry, exploit

• securiteam.com /exploits/6X00L20C0S.html

  exploit

• osvdb.org /12578

  vdb-entry, exploit

• taosecurity.blogspot.com /2004/12/details-on-snort-dos-condition-you-may.html

  exploit, vendor-advisory

• frsirt.com /exploits/20041222.angelDust.c.php
• exchange.xforce.ibmcloud.com /vulnerabilities/18689

  vdb-entry

• snort.org /arc_news/

• CVE List CVE-2004-2652
• NVD CVE-2004-2652

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.