CVE-2026-20125: Cisco IOS HTTP Server DoS Vulnerability

CVE-2026-20125 Overview

CVE-2026-20125 is a denial of service vulnerability in the HTTP Server feature of Cisco IOS Software and Cisco IOS XE Software Release 3E. The flaw stems from improper validation of user-supplied input in HTTP request handling. An authenticated remote attacker can send malformed HTTP requests to trigger a watchdog timer expiration, forcing the affected device to reload. Exploitation requires a valid user account on the target device. The weakness is classified under [CWE-228] (Improper Handling of Syntactically Invalid Structure).

Critical Impact
Successful exploitation causes affected Cisco IOS and IOS XE devices to reload unexpectedly, producing a denial of service condition that disrupts network availability.

Affected Products

Cisco IOS Software
Cisco IOS XE Software Release 3E
Devices with the HTTP Server feature enabled

Discovery Timeline

2026-03-25 - CVE-2026-20125 published to NVD
2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-20125

Vulnerability Analysis

The vulnerability resides in the embedded HTTP Server component of Cisco IOS and IOS XE Software Release 3E. The HTTP Server processes incoming requests without sufficiently validating syntactic structure. When a malformed request reaches the parser, the handling routine enters a state that prevents the process from yielding control. The watchdog timer detects the stall and forces a device reload to recover. The result is a transient outage that affects all traffic transiting or terminating on the device.

The attack is network-reachable but constrained to authenticated users with valid credentials. The vulnerability has a scope change because the failure in the HTTP Server process impacts the entire device, including unrelated routing and switching functions. Confidentiality and integrity are not affected, but availability impact is high.

Root Cause

The root cause is improper handling of syntactically invalid HTTP request structures supplied by authenticated users. Input validation does not reject or safely discard malformed fields before they reach downstream processing logic. The resulting condition prevents normal task scheduling, triggering watchdog-driven recovery.

Attack Vector

An authenticated attacker establishes an HTTP or HTTPS session to the management interface of a vulnerable Cisco device. The attacker then transmits a crafted HTTP request containing malformed elements. The HTTP Server process hangs on the malformed input. The watchdog timer expires and the device reloads, dropping all active sessions. Repeated exploitation can sustain a denial of service condition.

Detailed technical information is published in the Cisco Security Advisory.

Detection Methods for CVE-2026-20125

Indicators of Compromise

Unexpected device reloads correlated with HTTP or HTTPS traffic to the management interface
Crash logs referencing the HTTP Server process or watchdog timer expiration
Authentication events for low-privilege accounts immediately preceding a reload

Detection Strategies

Inspect Cisco device crashinfo files for watchdog timeouts tied to the ip http server process
Correlate authenticated HTTP or HTTPS sessions with subsequent device reboots using syslog and AAA accounting records
Alert on malformed HTTP request patterns directed at infrastructure management addresses

Monitoring Recommendations

Forward Cisco syslog and SNMP trap data to a centralized logging platform for reload and crash event correlation
Track authentication failures and successful logins against HTTP and HTTPS services on network devices
Baseline normal HTTP management traffic volume and alert on anomalous bursts of malformed requests

How to Mitigate CVE-2026-20125

Immediate Actions Required

Apply Cisco's published fixed software releases for IOS and IOS XE Release 3E as detailed in the vendor advisory
Disable the HTTP Server feature on devices where it is not required for operations
Restrict HTTP and HTTPS management access to trusted administrative subnets using infrastructure access control lists
Audit user accounts on Cisco devices and remove unused or unnecessary credentials

Patch Information

Cisco has published fixed software details in the Cisco Security Advisory cisco-sa-ios-http-dos-sbv8XRpL. Administrators should review the advisory for affected release trains and corresponding fixed versions.

Workarounds

Disable the embedded HTTP and HTTPS servers using no ip http server and no ip http secure-server if administrative web access is not required
Apply control-plane policing (CoPP) policies to rate-limit HTTP and HTTPS traffic destined for the device
Enforce access classes on the HTTP Server to restrict source addresses permitted to authenticate

bash

# Configuration example - disable embedded HTTP servers
configure terminal
 no ip http server
 no ip http secure-server
end
write memory

# Restrict HTTP access to a trusted management subnet
configure terminal
 access-list 10 permit 10.0.0.0 0.0.0.255
 ip http access-class 10
end