Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
216 vulnerabilities by OISF
CVE-2026-94084 (GCVE-0-2026-94084)
Vulnerability from nvd – Published: 2026-09-20 01:20 – Updated: 2026-09-22 18:27
VLAI
EPSS
VEX
Summary
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 18:24 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94084",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:24:29.351972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:27:33.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Suricata",
"vendor": "OISF",
"versions": [
{
"lessThan": "8.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.0.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T01:20:20.503Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://forum.suricata.io/t/suricata-8-0-7-released/6467"
},
{
"url": "https://github.com/OISF/suricata/commit/1d66355dc8737bb2ae7a198115b3067e3ad49808"
},
{
"url": "https://github.com/OISF/suricata/compare/suricata-8.0.6...suricata-8.0.7"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-94084",
"datePublished": "2026-09-20T01:20:20.503Z",
"dateReserved": "2026-09-20T01:20:20.153Z",
"dateUpdated": "2026-09-22T18:27:33.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94083 (GCVE-0-2026-94083)
Vulnerability from nvd – Published: 2026-09-20 01:18 – Updated: 2026-09-22 15:20
VLAI
EPSS
VEX
Summary
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:19 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94083",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:19:55.907673Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:20:03.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Suricata",
"vendor": "OISF",
"versions": [
{
"lessThan": "8.0.7",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.0.7",
"versionStartIncluding": "8.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T01:18:05.744Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://forum.suricata.io/t/suricata-8-0-7-released/6467"
},
{
"url": "https://github.com/OISF/suricata/commit/e574009add9c208f319e1d9d15b3bb1229c88074"
},
{
"url": "https://github.com/OISF/suricata/compare/suricata-8.0.6...suricata-8.0.7"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-94083",
"datePublished": "2026-09-20T01:18:05.744Z",
"dateReserved": "2026-09-20T01:18:05.348Z",
"dateUpdated": "2026-09-22T15:20:03.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71855 (GCVE-0-2026-71855)
Vulnerability from nvd – Published: 2026-09-18 20:25 – Updated: 2026-09-18 20:25
VLAI
EPSS
VEX
Title
Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.
Severity
5.9 (Medium)
CWE
- CWE-697 - Incorrect Comparison
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/181b3b2fd… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/4e2f23d03… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/bc41dcc85… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8558 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
},
{
"status": "affected",
"version": "\u003c 7.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-697",
"description": "CWE-697: Incorrect Comparison",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:25:58.646Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-fvwh-wjcq-2586",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-fvwh-wjcq-2586"
},
{
"name": "https://github.com/OISF/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f"
},
{
"name": "https://github.com/OISF/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701"
},
{
"name": "https://github.com/OISF/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8558",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8558"
}
],
"source": {
"advisory": "GHSA-fvwh-wjcq-2586",
"discovery": "UNKNOWN"
},
"title": "Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71855",
"datePublished": "2026-09-18T20:25:58.646Z",
"dateReserved": "2026-08-07T18:26:53.523Z",
"dateUpdated": "2026-09-18T20:25:58.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71418 (GCVE-0-2026-71418)
Vulnerability from nvd – Published: 2026-09-18 20:24 – Updated: 2026-09-21 20:47
VLAI
EPSS
VEX
Title
Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer. Multiple DATA frames with the EndOfStream flag set can grow the buffer to its 65 KiB limit while causing all prior contents to be processed again, producing quadratic CPU complexity, degraded packet processing, loss of monitoring visibility, or denial of service. This issue is fixed in version 8.0.6.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:48 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/173180596… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/26c26dea8… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8725 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71418",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:48:43.640552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:47:25.146Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer. Multiple DATA frames with the EndOfStream flag set can grow the buffer to its 65 KiB limit while causing all prior contents to be processed again, producing quadratic CPU complexity, degraded packet processing, loss of monitoring visibility, or denial of service. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:24:28.625Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-xjgq-3qw4-jp5f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-xjgq-3qw4-jp5f"
},
{
"name": "https://github.com/OISF/suricata/commit/1731805967edf5d31448db2ae43cf72c6cf46c11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/1731805967edf5d31448db2ae43cf72c6cf46c11"
},
{
"name": "https://github.com/OISF/suricata/commit/26c26dea84f00de95151a0e16d21c1fcafac9648",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/26c26dea84f00de95151a0e16d21c1fcafac9648"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8725",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8725"
}
],
"source": {
"advisory": "GHSA-xjgq-3qw4-jp5f",
"discovery": "UNKNOWN"
},
"title": "Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71418",
"datePublished": "2026-09-18T20:24:28.625Z",
"dateReserved": "2026-08-06T16:28:51.181Z",
"dateUpdated": "2026-09-21T20:47:25.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63452 (GCVE-0-2026-63452)
Vulnerability from nvd – Published: 2026-09-18 20:16 – Updated: 2026-09-21 18:19
VLAI
EPSS
VEX
Title
Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in rust/htp perform expensive work for every transaction, degrading packet processing and potentially causing loss of monitoring visibility or denial of service. This issue is fixed in version 8.0.6.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:19 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/392b6aee2… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/e369bf29e… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8694 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:19:39.620230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:19:52.084Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in rust/htp perform expensive work for every transaction, degrading packet processing and potentially causing loss of monitoring visibility or denial of service. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:16:51.951Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-j9cx-w9xm-5x84",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-j9cx-w9xm-5x84"
},
{
"name": "https://github.com/OISF/suricata/commit/392b6aee2971a4b5e573850f5d832112509bcb5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/392b6aee2971a4b5e573850f5d832112509bcb5f"
},
{
"name": "https://github.com/OISF/suricata/commit/e369bf29ee5bbd0cdf6a98dc4a3357ba43c86a88",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/e369bf29ee5bbd0cdf6a98dc4a3357ba43c86a88"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8694",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8694"
}
],
"source": {
"advisory": "GHSA-j9cx-w9xm-5x84",
"discovery": "UNKNOWN"
},
"title": "Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63452",
"datePublished": "2026-09-18T20:16:51.951Z",
"dateReserved": "2026-07-16T19:35:57.768Z",
"dateUpdated": "2026-09-21T18:19:52.084Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63451 (GCVE-0-2026-63451)
Vulnerability from nvd – Published: 2026-09-18 20:15 – Updated: 2026-09-21 16:21
VLAI
EPSS
VEX
Title
Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule load
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.c select multiple non-prefilter frame engines while preparing signatures for non-prefilter inspection. Loading the crafted rule, including in test mode, can trigger a heap buffer overflow and crash Suricata; network traffic alone cannot reach the flaw. This issue is fixed in version 8.0.6.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:21 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/pull/15807 | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/5449ae170… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/d62acf5d7… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8590 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63451",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:21:22.661133Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:21:36.434Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, a locally supplied detection rule that combines frame inspection without content and a transformed match without content can make src/detect-engine-prefilter.c select multiple non-prefilter frame engines while preparing signatures for non-prefilter inspection. Loading the crafted rule, including in test mode, can trigger a heap buffer overflow and crash Suricata; network traffic alone cannot reach the flaw. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:15:52.512Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-6qwq-j83r-qp34",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-6qwq-j83r-qp34"
},
{
"name": "https://github.com/OISF/suricata/pull/15807",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/pull/15807"
},
{
"name": "https://github.com/OISF/suricata/commit/5449ae170bfce213907d9bab87143a59774ed48f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/5449ae170bfce213907d9bab87143a59774ed48f"
},
{
"name": "https://github.com/OISF/suricata/commit/d62acf5d75a61b76b16815e773408852f41b1975",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/d62acf5d75a61b76b16815e773408852f41b1975"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8590",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8590"
}
],
"source": {
"advisory": "GHSA-6qwq-j83r-qp34",
"discovery": "UNKNOWN"
},
"title": "Suricata detect: frame rules without content and with transform can cause heap buffer overflow during rule load"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63451",
"datePublished": "2026-09-18T20:15:52.512Z",
"dateReserved": "2026-07-16T19:35:57.768Z",
"dateUpdated": "2026-09-21T16:21:36.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63450 (GCVE-0-2026-63450)
Vulnerability from nvd – Published: 2026-09-18 20:13 – Updated: 2026-09-23 19:45
VLAI
EPSS
VEX
Title
Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow. This issue is fixed in version 8.0.6.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 19:45 UTC
CWE
- CWE-755 - Improper Handling of Exceptional Conditions
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/pull/15704 | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/52490b8c2… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/feb0ff911… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8659 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T19:45:24.754319Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:45:34.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 8.0.6, the FTP parser in src/app-layer-ftp.c treats a RETR or STOR command sent before PORT or PASV negotiation as a fatal application-layer error instead of a recoverable protocol event. The fatal state disables FTP application-layer parsing for the remainder of the TCP flow, so later commands can evade parser-dependent rules and logging; IPS mode instead drops the flow. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-755",
"description": "CWE-755: Improper Handling of Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:13:42.549Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-56wx-7hqh-wfgr",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-56wx-7hqh-wfgr"
},
{
"name": "https://github.com/OISF/suricata/pull/15704",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/pull/15704"
},
{
"name": "https://github.com/OISF/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/52490b8c26909772801afed98df63a6d62f3af18"
},
{
"name": "https://github.com/OISF/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/feb0ff91159cea474a983adf92e4b56fb16e4ffc"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8659",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8659"
}
],
"source": {
"advisory": "GHSA-56wx-7hqh-wfgr",
"discovery": "UNKNOWN"
},
"title": "Suricata ftp: RETR/STOR before PORT/PASV can disable further IDS app-layer detection"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63450",
"datePublished": "2026-09-18T20:13:42.549Z",
"dateReserved": "2026-07-16T19:35:57.768Z",
"dateUpdated": "2026-09-23T19:45:34.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63449 (GCVE-0-2026-63449)
Vulnerability from nvd – Published: 2026-09-18 20:12 – Updated: 2026-09-21 20:47
VLAI
EPSS
VEX
Title
Suricata sip: large SIP message bodies can evade detection with frame keyword
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the length and prevent frame:request.body or frame:response.body from exposing the complete body to inspection, allowing content in the omitted portion to evade frame-based detection. This issue is fixed in version 8.0.6.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:40 UTC
CWE
- CWE-197 - Numeric Truncation Error
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/pull/15807 | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/499995bf0… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/6f87930af… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8582 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63449",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:40:15.263931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:47:32.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SIP parser in rust/src/sip/parser.rs stores request and response body lengths in 16-bit fields. A SIP body larger than 65,536 bytes can truncate the length and prevent frame:request.body or frame:response.body from exposing the complete body to inspection, allowing content in the omitted portion to evade frame-based detection. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-197",
"description": "CWE-197: Numeric Truncation Error",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:12:30.737Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-prqx-q74v-wxhv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-prqx-q74v-wxhv"
},
{
"name": "https://github.com/OISF/suricata/pull/15807",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/pull/15807"
},
{
"name": "https://github.com/OISF/suricata/commit/499995bf0e5eab34b647ec1024ce65d72c411816",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/499995bf0e5eab34b647ec1024ce65d72c411816"
},
{
"name": "https://github.com/OISF/suricata/commit/6f87930aff1e2294e46289cb9cbf4d96d79a209a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/6f87930aff1e2294e46289cb9cbf4d96d79a209a"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8582",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8582"
}
],
"source": {
"advisory": "GHSA-prqx-q74v-wxhv",
"discovery": "UNKNOWN"
},
"title": "Suricata sip: large SIP message bodies can evade detection with frame keyword"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63449",
"datePublished": "2026-09-18T20:12:30.737Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-09-21T20:47:32.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63448 (GCVE-0-2026-63448)
Vulnerability from nvd – Published: 2026-09-18 20:20 – Updated: 2026-09-22 15:48
VLAI
EPSS
VEX
Title
Suricata smb: some SMB flows can cause resource exhaustion
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:48 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/755d6c306… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/7ec9d72d2… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/88adab8bd… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/9a54a0435… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/bc39274a6… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/c8f68b0e4… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8629 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63448",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:48:35.862458Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:48:51.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
},
{
"status": "affected",
"version": "\u003c 7.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401: Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:20:01.185Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-hvvj-c8xx-9g35",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-hvvj-c8xx-9g35"
},
{
"name": "https://github.com/OISF/suricata/commit/755d6c3061de4d7ba97f0ed31cdc17ab8cab4476",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/755d6c3061de4d7ba97f0ed31cdc17ab8cab4476"
},
{
"name": "https://github.com/OISF/suricata/commit/7ec9d72d28b9370712cf77a5b9d40d6b5db27cb4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/7ec9d72d28b9370712cf77a5b9d40d6b5db27cb4"
},
{
"name": "https://github.com/OISF/suricata/commit/88adab8bd3d62912941647ab65032d5ec75c893a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/88adab8bd3d62912941647ab65032d5ec75c893a"
},
{
"name": "https://github.com/OISF/suricata/commit/9a54a043516e644bb7b9d34117a91977f950a281",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/9a54a043516e644bb7b9d34117a91977f950a281"
},
{
"name": "https://github.com/OISF/suricata/commit/bc39274a638d1cca2391cfa4891c8b6c255ff9ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/bc39274a638d1cca2391cfa4891c8b6c255ff9ce"
},
{
"name": "https://github.com/OISF/suricata/commit/c8f68b0e4f9e721dca1c9ed6e08597c6964c7ac3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/c8f68b0e4f9e721dca1c9ed6e08597c6964c7ac3"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8629",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8629"
}
],
"source": {
"advisory": "GHSA-hvvj-c8xx-9g35",
"discovery": "UNKNOWN"
},
"title": "Suricata smb: some SMB flows can cause resource exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63448",
"datePublished": "2026-09-18T20:20:01.185Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-09-22T15:48:51.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63447 (GCVE-0-2026-63447)
Vulnerability from nvd – Published: 2026-09-18 20:21 – Updated: 2026-09-21 18:21
VLAI
EPSS
VEX
Title
Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:21 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/15bf91c5c… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/82c419055… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8592 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:21:07.869708Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:21:33.801Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.5, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:21:06.510Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9"
},
{
"name": "https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385"
},
{
"name": "https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8592",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8592"
}
],
"source": {
"advisory": "GHSA-w394-3g33-3jg9",
"discovery": "UNKNOWN"
},
"title": "Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63447",
"datePublished": "2026-09-18T20:21:06.510Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-09-21T18:21:33.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63446 (GCVE-0-2026-63446)
Vulnerability from nvd – Published: 2026-09-18 20:22 – Updated: 2026-09-21 16:20
VLAI
EPSS
VEX
Title
Suricata app-layer: passed flows can retain transactions, causing resource exhaustion
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:18 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/pull/15726 | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/006e21c1c… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/60a83c62a… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8628 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63446",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:18:53.670399Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:20:22.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401: Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:22:15.562Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-gjwr-75gq-877m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-gjwr-75gq-877m"
},
{
"name": "https://github.com/OISF/suricata/pull/15726",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/pull/15726"
},
{
"name": "https://github.com/OISF/suricata/commit/006e21c1ccc38c1c815e7945d54b4638cc5f0de8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/006e21c1ccc38c1c815e7945d54b4638cc5f0de8"
},
{
"name": "https://github.com/OISF/suricata/commit/60a83c62a1dfdfb589b2bad27fb7fc339fc964b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/60a83c62a1dfdfb589b2bad27fb7fc339fc964b7"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8628",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8628"
}
],
"source": {
"advisory": "GHSA-gjwr-75gq-877m",
"discovery": "UNKNOWN"
},
"title": "Suricata app-layer: passed flows can retain transactions, causing resource exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63446",
"datePublished": "2026-09-18T20:22:15.562Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-09-21T16:20:22.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57229 (GCVE-0-2026-57229)
Vulnerability from nvd – Published: 2026-09-18 20:18 – Updated: 2026-09-18 20:18
VLAI
EPSS
VEX
Title
Suricata smtp/mime: incomplete state reset allows detection bypass
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's encoding or filename state can leak into the inner message, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs when SMTP MIME decoding is enabled. This issue is fixed in version 8.0.6.
Severity
5.3 (Medium)
CWE
- CWE-665 - Improper Initialization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/4985eb9da… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/c0215c7e1… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8649 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part\u0027s encoding or filename state can leak into the inner message, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs when SMTP MIME decoding is enabled. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665: Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:18:38.625Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-ph5p-pm8r-m355",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-ph5p-pm8r-m355"
},
{
"name": "https://github.com/OISF/suricata/commit/4985eb9daea2f765b6ef59a58fa02e5c71c0a77c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/4985eb9daea2f765b6ef59a58fa02e5c71c0a77c"
},
{
"name": "https://github.com/OISF/suricata/commit/c0215c7e175b0000ef8450928dd1f3453c48379b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/c0215c7e175b0000ef8450928dd1f3453c48379b"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8649",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8649"
}
],
"source": {
"advisory": "GHSA-ph5p-pm8r-m355",
"discovery": "UNKNOWN"
},
"title": "Suricata smtp/mime: incomplete state reset allows detection bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57229",
"datePublished": "2026-09-18T20:18:38.625Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-09-18T20:18:38.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57228 (GCVE-0-2026-57228)
Vulnerability from nvd – Published: 2026-09-18 20:11 – Updated: 2026-09-21 20:47
VLAI
EPSS
VEX
Title
Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte. Crafted SMTP traffic can trigger the out-of-bounds read and crash Suricata when decode-quoted-printable MIME decoding is enabled. This issue is fixed in version 7.0.17.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:48 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/19880f9d5… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8608 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57228",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:48:41.391355Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:47:40.290Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 7.0.13, \u003c 7.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.13 until 7.0.17, the SMTP MIME quoted-printable decoder in src/util-decode-mime.c can read one byte past a heap buffer when a quoted-printable escape sequence is split across traffic chunks and the following chunk contains exactly one byte. Crafted SMTP traffic can trigger the out-of-bounds read and crash Suricata when decode-quoted-printable MIME decoding is enabled. This issue is fixed in version 7.0.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:11:24.343Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-qxm4-q7vx-7xj4",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-qxm4-q7vx-7xj4"
},
{
"name": "https://github.com/OISF/suricata/commit/19880f9d5bbe2b8f8e8867a577848dce2b532c86",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/19880f9d5bbe2b8f8e8867a577848dce2b532c86"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8608",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8608"
}
],
"source": {
"advisory": "GHSA-qxm4-q7vx-7xj4",
"discovery": "UNKNOWN"
},
"title": "Suricata smtp/mime: heap out-of-bounds read quoted-printable decoder"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57228",
"datePublished": "2026-09-18T20:11:24.343Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-09-21T20:47:40.290Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57227 (GCVE-0-2026-57227)
Vulnerability from nvd – Published: 2026-09-18 20:14 – Updated: 2026-09-22 15:47
VLAI
EPSS
VEX
Title
Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted MQTT traffic can grow transaction state indefinitely, consuming CPU and memory and causing slowdown or denial of service. This issue is fixed in versions 8.0.6 and 7.0.17.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:47 UTC
CWE
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/03ba8a71d… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/5cde93dea… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/c03666d26… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8525 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57227",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:47:25.096325Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:47:38.925Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
},
{
"status": "affected",
"version": "\u003e= 7.0.0, \u003c 7.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 7.0.0 until 7.0.17 and 8.0.6, the MQTT parser in rust/src/mqtt/mqtt.rs permits repeated PUBREC or PUBREL messages to be appended to one transaction without a limit. Crafted MQTT traffic can grow transaction state indefinitely, consuming CPU and memory and causing slowdown or denial of service. This issue is fixed in versions 8.0.6 and 7.0.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:14:55.843Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-7h2h-hpj2-9w6p",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-7h2h-hpj2-9w6p"
},
{
"name": "https://github.com/OISF/suricata/commit/03ba8a71d827dd36a0ceb512f45d2f440f260a3a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/03ba8a71d827dd36a0ceb512f45d2f440f260a3a"
},
{
"name": "https://github.com/OISF/suricata/commit/5cde93dea38533c9b225128ba9d54955997dc273",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/5cde93dea38533c9b225128ba9d54955997dc273"
},
{
"name": "https://github.com/OISF/suricata/commit/c03666d261256df5a2d1f5800872da8a5addf6a5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/c03666d261256df5a2d1f5800872da8a5addf6a5"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8525",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8525"
}
],
"source": {
"advisory": "GHSA-7h2h-hpj2-9w6p",
"discovery": "UNKNOWN"
},
"title": "Suricata mqtt: unbounded resource consumption from repeated pubrec and pubrel messages"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57227",
"datePublished": "2026-09-18T20:14:55.843Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-09-22T15:47:38.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57225 (GCVE-0-2026-57225)
Vulnerability from nvd – Published: 2026-09-18 20:17 – Updated: 2026-09-21 18:20
VLAI
EPSS
VEX
Title
Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:20 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/pull/15699 | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/3ca2ed25a… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/bd3293aca… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8624 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57225",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:20:30.389906Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:20:38.141Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:17:48.513Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-vqqx-88xw-qqvc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-vqqx-88xw-qqvc"
},
{
"name": "https://github.com/OISF/suricata/pull/15699",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/pull/15699"
},
{
"name": "https://github.com/OISF/suricata/commit/3ca2ed25a324597a85a2ab11595c3b0689468ea5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/3ca2ed25a324597a85a2ab11595c3b0689468ea5"
},
{
"name": "https://github.com/OISF/suricata/commit/bd3293aca714f5d090b73e7d9be0e5cd7e3f5f53",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/bd3293aca714f5d090b73e7d9be0e5cd7e3f5f53"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8624",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8624"
}
],
"source": {
"advisory": "GHSA-vqqx-88xw-qqvc",
"discovery": "UNKNOWN"
},
"title": "Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57225",
"datePublished": "2026-09-18T20:17:48.513Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-09-21T18:20:38.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57223 (GCVE-0-2026-57223)
Vulnerability from nvd – Published: 2026-09-18 20:23 – Updated: 2026-09-22 15:50
VLAI
EPSS
VEX
Title
Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:49 UTC
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/pull/15676 | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/0dad38fff… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/2b924d47c… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/ac1b3cc1e… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8600 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57223",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:49:59.518563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:50:19.808Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
},
{
"status": "affected",
"version": "\u003c 7.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "CWE-428: Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:23:28.227Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-jh8w-wf3f-58jp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-jh8w-wf3f-58jp"
},
{
"name": "https://github.com/OISF/suricata/pull/15676",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/pull/15676"
},
{
"name": "https://github.com/OISF/suricata/commit/0dad38fff024b4fec9bc8144d8b94dbca39aac2e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/0dad38fff024b4fec9bc8144d8b94dbca39aac2e"
},
{
"name": "https://github.com/OISF/suricata/commit/2b924d47cc51d0b7760cda3519f2c04a2f65ea38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/2b924d47cc51d0b7760cda3519f2c04a2f65ea38"
},
{
"name": "https://github.com/OISF/suricata/commit/ac1b3cc1ef3af65ce92da28261d445167eb8234d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/ac1b3cc1ef3af65ce92da28261d445167eb8234d"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8600",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8600"
}
],
"source": {
"advisory": "GHSA-jh8w-wf3f-58jp",
"discovery": "UNKNOWN"
},
"title": "Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57223",
"datePublished": "2026-09-18T20:23:28.227Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-09-22T15:50:19.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57226 (GCVE-0-2026-57226)
Vulnerability from nvd – Published: 2026-09-18 20:07 – Updated: 2026-09-22 15:45
VLAI
EPSS
VEX
Title
Suricata swf: heap buffer overflow in SWF decompression depth handling
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/util-file-decompression.c instead of limiting the allocation to the Flash file's actual data requirement. A crafted SWF response can therefore trigger an integer-related heap buffer overflow and crash Suricata; the default disabled feature and default depth are not affected. This issue is fixed in versions 8.0.6 and 7.0.17.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:45 UTC
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/pull/15704 | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/82af0aeb7… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/b63224871… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/d9fae1843… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8642 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57226",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:45:40.054734Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:45:53.283Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
},
{
"status": "affected",
"version": "\u003c 7.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, HTTP SWF decompression with the non-default swf-decompression feature and an unsafe decompress-depth can use the configured depth when allocating in src/util-file-decompression.c instead of limiting the allocation to the Flash file\u0027s actual data requirement. A crafted SWF response can therefore trigger an integer-related heap buffer overflow and crash Suricata; the default disabled feature and default depth are not affected. This issue is fixed in versions 8.0.6 and 7.0.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "CWE-122: Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190: Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:07:31.465Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-p33j-r48q-3jcf",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-p33j-r48q-3jcf"
},
{
"name": "https://github.com/OISF/suricata/pull/15704",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/pull/15704"
},
{
"name": "https://github.com/OISF/suricata/commit/82af0aeb7cec39e206a9ca96c4966425eddeaa74",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/82af0aeb7cec39e206a9ca96c4966425eddeaa74"
},
{
"name": "https://github.com/OISF/suricata/commit/b63224871b0f8b0b1f7b8c22d05ba8a5c5f69fbb",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/b63224871b0f8b0b1f7b8c22d05ba8a5c5f69fbb"
},
{
"name": "https://github.com/OISF/suricata/commit/d9fae18432501674338e28bd33e35788c95d4a98",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/d9fae18432501674338e28bd33e35788c95d4a98"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8642",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8642"
}
],
"source": {
"advisory": "GHSA-p33j-r48q-3jcf",
"discovery": "UNKNOWN"
},
"title": "Suricata swf: heap buffer overflow in SWF decompression depth handling"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57226",
"datePublished": "2026-09-18T20:07:31.465Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-09-22T15:45:53.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57224 (GCVE-0-2026-57224)
Vulnerability from nvd – Published: 2026-09-18 20:08 – Updated: 2026-09-18 20:22
VLAI
EPSS
VEX
Title
Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::for_direction(), so a sensor that observes only one direction cannot mark the unseen direction inspected or free completed transactions. The RDP parser in rust/src/rdp/rdp.rs has the same direction-state defect. The per-flow transaction list can grow without bound and cleanup repeatedly scans it, causing increasing CPU and memory consumption and eventual denial of service. This issue is fixed in version 8.0.6.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-18 20:22 UTC
CWE
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/pull/15740 | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/3f86c56c8… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/5af13e3eb… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/bac8a69ca… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/ef035c760… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8621 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57224",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-18T20:22:12.045094Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:22:23.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the DHCP parser in rust/src/dhcp/dhcp.rs creates stateless transactions without recording their packet direction with AppLayerTxData::for_direction(), so a sensor that observes only one direction cannot mark the unseen direction inspected or free completed transactions. The RDP parser in rust/src/rdp/rdp.rs has the same direction-state defect. The per-flow transaction list can grow without bound and cleanup repeatedly scans it, causing increasing CPU and memory consumption and eventual denial of service. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "CWE-770: Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:08:46.402Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-m2vc-g65c-ph7m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-m2vc-g65c-ph7m"
},
{
"name": "https://github.com/OISF/suricata/pull/15740",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/pull/15740"
},
{
"name": "https://github.com/OISF/suricata/commit/3f86c56c800392ede5cfaf7a944a431fd8445c55",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/3f86c56c800392ede5cfaf7a944a431fd8445c55"
},
{
"name": "https://github.com/OISF/suricata/commit/5af13e3eb06be0387da8703b611c5ce932245c59",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/5af13e3eb06be0387da8703b611c5ce932245c59"
},
{
"name": "https://github.com/OISF/suricata/commit/bac8a69ca48c14582d39a244a87edad44751ebe1",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/bac8a69ca48c14582d39a244a87edad44751ebe1"
},
{
"name": "https://github.com/OISF/suricata/commit/ef035c7603293a10c5ad087e3d20b05f75236144",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/ef035c7603293a10c5ad087e3d20b05f75236144"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8621",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8621"
}
],
"source": {
"advisory": "GHSA-m2vc-g65c-ph7m",
"discovery": "UNKNOWN"
},
"title": "Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57224",
"datePublished": "2026-09-18T20:08:46.402Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-09-18T20:22:23.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57222 (GCVE-0-2026-57222)
Vulnerability from nvd – Published: 2026-09-18 20:05 – Updated: 2026-09-21 16:22
VLAI
EPSS
VEX
Title
Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-backed state. This can apply state from one IP family to another for xbits track ip_pair, FTP data expectations, and, on the 7.0 release line, thresholding, detection_filter, and rate_filter rules using track by_both, causing incorrect detection state. This issue is fixed in versions 8.0.6 and 7.0.17.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:22 UTC
CWE
- CWE-697 - Incorrect Comparison
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/4a728464e… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/9d788575c… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/c92e270c4… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8559 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57222",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:22:02.524626Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:22:19.565Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
},
{
"status": "affected",
"version": "\u003c 7.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, crafted IPv4 and IPv6 address pairs can collide in the IPPair hash because src/ippair.c did not compare the IP address family before reusing IPPair-backed state. This can apply state from one IP family to another for xbits track ip_pair, FTP data expectations, and, on the 7.0 release line, thresholding, detection_filter, and rate_filter rules using track by_both, causing incorrect detection state. This issue is fixed in versions 8.0.6 and 7.0.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-697",
"description": "CWE-697: Incorrect Comparison",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:05:15.072Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-2r8x-23fw-hgcg",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-2r8x-23fw-hgcg"
},
{
"name": "https://github.com/OISF/suricata/commit/4a728464e6eb9e273bb02e3df0c28929b28db71d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/4a728464e6eb9e273bb02e3df0c28929b28db71d"
},
{
"name": "https://github.com/OISF/suricata/commit/9d788575c5d22a34eeed50d56557ed12b05e0aec",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/9d788575c5d22a34eeed50d56557ed12b05e0aec"
},
{
"name": "https://github.com/OISF/suricata/commit/c92e270c4a795c52bce610aa1ce9ebaf065c49e6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/c92e270c4a795c52bce610aa1ce9ebaf065c49e6"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8559",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8559"
}
],
"source": {
"advisory": "GHSA-2r8x-23fw-hgcg",
"discovery": "UNKNOWN"
},
"title": "Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57222",
"datePublished": "2026-09-18T20:05:15.072Z",
"dateReserved": "2026-06-24T02:21:33.810Z",
"dateUpdated": "2026-09-21T16:22:19.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94084 (GCVE-0-2026-94084)
Vulnerability from cvelistv5 – Published: 2026-09-20 01:20 – Updated: 2026-09-22 18:27
VLAI
EPSS
VEX
Summary
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 18:24 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94084",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T18:24:29.351972Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T18:27:33.350Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Suricata",
"vendor": "OISF",
"versions": [
{
"lessThan": "8.0.7",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.0.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with and without a transform."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T01:20:20.503Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://forum.suricata.io/t/suricata-8-0-7-released/6467"
},
{
"url": "https://github.com/OISF/suricata/commit/1d66355dc8737bb2ae7a198115b3067e3ad49808"
},
{
"url": "https://github.com/OISF/suricata/compare/suricata-8.0.6...suricata-8.0.7"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-94084",
"datePublished": "2026-09-20T01:20:20.503Z",
"dateReserved": "2026-09-20T01:20:20.153Z",
"dateUpdated": "2026-09-22T18:27:33.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94083 (GCVE-0-2026-94083)
Vulnerability from cvelistv5 – Published: 2026-09-20 01:18 – Updated: 2026-09-22 15:20
VLAI
EPSS
VEX
Summary
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:19 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94083",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:19:55.907673Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:20:03.227Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Suricata",
"vendor": "OISF",
"versions": [
{
"lessThan": "8.0.7",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:oisf:suricata:*:*:*:*:*:*:*:*",
"versionEndExcluding": "8.0.7",
"versionStartIncluding": "8.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is the default in 8.x versions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "CWE-843 Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-20T01:18:05.744Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://forum.suricata.io/t/suricata-8-0-7-released/6467"
},
{
"url": "https://github.com/OISF/suricata/commit/e574009add9c208f319e1d9d15b3bb1229c88074"
},
{
"url": "https://github.com/OISF/suricata/compare/suricata-8.0.6...suricata-8.0.7"
}
],
"x_generator": {
"engine": "CVE-Request-form 0.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2026-94083",
"datePublished": "2026-09-20T01:18:05.744Z",
"dateReserved": "2026-09-20T01:18:05.348Z",
"dateUpdated": "2026-09-22T15:20:03.227Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71855 (GCVE-0-2026-71855)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:25 – Updated: 2026-09-18 20:25
VLAI
EPSS
VEX
Title
Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17.
Severity
5.9 (Medium)
CWE
- CWE-697 - Incorrect Comparison
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/181b3b2fd… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/4e2f23d03… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/bc41dcc85… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8558 | x_refsource_MISC |
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
},
{
"status": "affected",
"version": "\u003c 7.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align. An IPv6 packet can therefore reuse IPv4 flow state or the reverse, causing incorrect flowbit state, detection bypass, or IP-only bypass. This issue is fixed in versions 8.0.6 and 7.0.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-697",
"description": "CWE-697: Incorrect Comparison",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:25:58.646Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-fvwh-wjcq-2586",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-fvwh-wjcq-2586"
},
{
"name": "https://github.com/OISF/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/181b3b2fdd1fe87e4534de4fc79e29a083ef125f"
},
{
"name": "https://github.com/OISF/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/4e2f23d031fbcfd72883bacd3d723c9874f23701"
},
{
"name": "https://github.com/OISF/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/bc41dcc854e24487d3786ce578a8a86a8350ab20"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8558",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8558"
}
],
"source": {
"advisory": "GHSA-fvwh-wjcq-2586",
"discovery": "UNKNOWN"
},
"title": "Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71855",
"datePublished": "2026-09-18T20:25:58.646Z",
"dateReserved": "2026-08-07T18:26:53.523Z",
"dateUpdated": "2026-09-18T20:25:58.646Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71418 (GCVE-0-2026-71418)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:24 – Updated: 2026-09-21 20:47
VLAI
EPSS
VEX
Title
Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer. Multiple DATA frames with the EndOfStream flag set can grow the buffer to its 65 KiB limit while causing all prior contents to be processed again, producing quadratic CPU complexity, degraded packet processing, loss of monitoring visibility, or denial of service. This issue is fixed in version 8.0.6.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 19:48 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/173180596… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/26c26dea8… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8725 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71418",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T19:48:43.640552Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T20:47:25.146Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, DNS-over-HTTP/2 processing in rust/src/http2/http2.rs retains previously processed HTTP/2 DATA frame contents instead of clearing the internal buffer. Multiple DATA frames with the EndOfStream flag set can grow the buffer to its 65 KiB limit while causing all prior contents to be processed again, producing quadratic CPU complexity, degraded packet processing, loss of monitoring visibility, or denial of service. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:24:28.625Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-xjgq-3qw4-jp5f",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-xjgq-3qw4-jp5f"
},
{
"name": "https://github.com/OISF/suricata/commit/1731805967edf5d31448db2ae43cf72c6cf46c11",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/1731805967edf5d31448db2ae43cf72c6cf46c11"
},
{
"name": "https://github.com/OISF/suricata/commit/26c26dea84f00de95151a0e16d21c1fcafac9648",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/26c26dea84f00de95151a0e16d21c1fcafac9648"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8725",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8725"
}
],
"source": {
"advisory": "GHSA-xjgq-3qw4-jp5f",
"discovery": "UNKNOWN"
},
"title": "Suricata doh2: crafted HTTP/2 DATA frames can cause quadratic CPU consumption"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-71418",
"datePublished": "2026-09-18T20:24:28.625Z",
"dateReserved": "2026-08-06T16:28:51.181Z",
"dateUpdated": "2026-09-21T20:47:25.146Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57223 (GCVE-0-2026-57223)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:23 – Updated: 2026-09-22 15:50
VLAI
EPSS
VEX
Title
Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:49 UTC
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/pull/15676 | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/0dad38fff… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/2b924d47c… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/ac1b3cc1e… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8600 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57223",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:49:59.518563Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:50:19.808Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
},
{
"status": "affected",
"version": "\u003c 7.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Suricata is installed below a path containing spaces and an earlier path component is writable by a local low-privileged attacker, Windows can execute an attacker-controlled program as LocalSystem, resulting in local privilege escalation. This issue is fixed in versions 8.0.6 and 7.0.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "CWE-428: Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:23:28.227Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-jh8w-wf3f-58jp",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-jh8w-wf3f-58jp"
},
{
"name": "https://github.com/OISF/suricata/pull/15676",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/pull/15676"
},
{
"name": "https://github.com/OISF/suricata/commit/0dad38fff024b4fec9bc8144d8b94dbca39aac2e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/0dad38fff024b4fec9bc8144d8b94dbca39aac2e"
},
{
"name": "https://github.com/OISF/suricata/commit/2b924d47cc51d0b7760cda3519f2c04a2f65ea38",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/2b924d47cc51d0b7760cda3519f2c04a2f65ea38"
},
{
"name": "https://github.com/OISF/suricata/commit/ac1b3cc1ef3af65ce92da28261d445167eb8234d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/ac1b3cc1ef3af65ce92da28261d445167eb8234d"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8600",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8600"
}
],
"source": {
"advisory": "GHSA-jh8w-wf3f-58jp",
"discovery": "UNKNOWN"
},
"title": "Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57223",
"datePublished": "2026-09-18T20:23:28.227Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-09-22T15:50:19.808Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63446 (GCVE-0-2026-63446)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:22 – Updated: 2026-09-21 16:20
VLAI
EPSS
VEX
Title
Suricata app-layer: passed flows can retain transactions, causing resource exhaustion
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 16:18 UTC
CWE
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/pull/15726 | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/006e21c1c… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/60a83c62a… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8628 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63446",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T16:18:53.670399Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T16:20:22.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, AppLayerParserSetTransactionInspectId() in src/app-layer-parser.c uses an inverted guard and marks only already-inspected transactions as inspected. On flows passed by a pass rule or pass-the-flow exception policy, detection is skipped, so completed transactions remain unmarked, are never freed, and are repeatedly rescanned. The per-flow list can grow without bound with quadratic cleanup cost, causing CPU and memory exhaustion. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401: Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:22:15.562Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-gjwr-75gq-877m",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-gjwr-75gq-877m"
},
{
"name": "https://github.com/OISF/suricata/pull/15726",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/pull/15726"
},
{
"name": "https://github.com/OISF/suricata/commit/006e21c1ccc38c1c815e7945d54b4638cc5f0de8",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/006e21c1ccc38c1c815e7945d54b4638cc5f0de8"
},
{
"name": "https://github.com/OISF/suricata/commit/60a83c62a1dfdfb589b2bad27fb7fc339fc964b7",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/60a83c62a1dfdfb589b2bad27fb7fc339fc964b7"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8628",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8628"
}
],
"source": {
"advisory": "GHSA-gjwr-75gq-877m",
"discovery": "UNKNOWN"
},
"title": "Suricata app-layer: passed flows can retain transactions, causing resource exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63446",
"datePublished": "2026-09-18T20:22:15.562Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-09-21T16:20:22.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63447 (GCVE-0-2026-63447)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:21 – Updated: 2026-09-21 18:21
VLAI
EPSS
VEX
Title
Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:21 UTC
CWE
- CWE-407 - Inefficient Algorithmic Complexity
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/15bf91c5c… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/82c419055… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8592 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:21:07.869708Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:21:33.801Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.5, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.5 until 8.0.6, the FTP parser in src/app-layer-ftp.c can continue allocating transactions after app-layer.protocols.ftp.max-tx is reached while processing one large chunk of FTP command data. The oversized transaction list is repeatedly processed with quadratic complexity after the too_many_transactions event, allowing crafted FTP traffic to degrade packet processing, reduce monitoring visibility, or cause denial of service. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:21:06.510Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-w394-3g33-3jg9"
},
{
"name": "https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/15bf91c5ccbbbf640cd042e1c96974b262549385"
},
{
"name": "https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/82c41905589305e8389ceb793907ccb74798aee5"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8592",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8592"
}
],
"source": {
"advisory": "GHSA-w394-3g33-3jg9",
"discovery": "UNKNOWN"
},
"title": "Suricata ftp: crafted FTP traffic can cause quadratic CPU consumption"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63447",
"datePublished": "2026-09-18T20:21:06.510Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-09-21T18:21:33.801Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63448 (GCVE-0-2026-63448)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:20 – Updated: 2026-09-22 15:48
VLAI
EPSS
VEX
Title
Suricata smb: some SMB flows can cause resource exhaustion
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-22 15:48 UTC
CWE
Assigner
References
10 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/755d6c306… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/7ec9d72d2… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/88adab8bd… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/9a54a0435… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/bc39274a6… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/c8f68b0e4… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8629 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63448",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-22T15:48:35.862458Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-22T15:48:51.877Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
},
{
"status": "affected",
"version": "\u003c 7.0.17"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, because cleanup waits for inspection in the unseen direction. The transaction creation paths in rust/src/smb can exceed the intended SMB_MAX_TX bound, and cleanup repeatedly scans the growing list. Sustained one-directional SMB traffic can therefore cause unbounded per-flow state and CPU and memory exhaustion. This issue is fixed in versions 8.0.6 and 7.0.17."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-401",
"description": "CWE-401: Missing Release of Memory after Effective Lifetime",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-407",
"description": "CWE-407: Inefficient Algorithmic Complexity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:20:01.185Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-hvvj-c8xx-9g35",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-hvvj-c8xx-9g35"
},
{
"name": "https://github.com/OISF/suricata/commit/755d6c3061de4d7ba97f0ed31cdc17ab8cab4476",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/755d6c3061de4d7ba97f0ed31cdc17ab8cab4476"
},
{
"name": "https://github.com/OISF/suricata/commit/7ec9d72d28b9370712cf77a5b9d40d6b5db27cb4",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/7ec9d72d28b9370712cf77a5b9d40d6b5db27cb4"
},
{
"name": "https://github.com/OISF/suricata/commit/88adab8bd3d62912941647ab65032d5ec75c893a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/88adab8bd3d62912941647ab65032d5ec75c893a"
},
{
"name": "https://github.com/OISF/suricata/commit/9a54a043516e644bb7b9d34117a91977f950a281",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/9a54a043516e644bb7b9d34117a91977f950a281"
},
{
"name": "https://github.com/OISF/suricata/commit/bc39274a638d1cca2391cfa4891c8b6c255ff9ce",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/bc39274a638d1cca2391cfa4891c8b6c255ff9ce"
},
{
"name": "https://github.com/OISF/suricata/commit/c8f68b0e4f9e721dca1c9ed6e08597c6964c7ac3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/c8f68b0e4f9e721dca1c9ed6e08597c6964c7ac3"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-7.0.17"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8629",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8629"
}
],
"source": {
"advisory": "GHSA-hvvj-c8xx-9g35",
"discovery": "UNKNOWN"
},
"title": "Suricata smb: some SMB flows can cause resource exhaustion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63448",
"datePublished": "2026-09-18T20:20:01.185Z",
"dateReserved": "2026-07-16T19:35:57.767Z",
"dateUpdated": "2026-09-22T15:48:51.877Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57229 (GCVE-0-2026-57229)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:18 – Updated: 2026-09-18 20:18
VLAI
EPSS
VEX
Title
Suricata smtp/mime: incomplete state reset allows detection bypass
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part's encoding or filename state can leak into the inner message, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs when SMTP MIME decoding is enabled. This issue is fixed in version 8.0.6.
Severity
5.3 (Medium)
CWE
- CWE-665 - Improper Initialization
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/4985eb9da… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/c0215c7e1… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8649 | x_refsource_MISC |
{
"containers": {
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the SMTP MIME parser in rust/src/mime/smtp.rs does not fully reset state when processing Content-Type: message/rfc822 encapsulation. An outer MIME part\u0027s encoding or filename state can leak into the inner message, allowing crafted mail to evade detections based on file.data, file.name, or extracted URLs when SMTP MIME decoding is enabled. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665: Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:18:38.625Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-ph5p-pm8r-m355",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-ph5p-pm8r-m355"
},
{
"name": "https://github.com/OISF/suricata/commit/4985eb9daea2f765b6ef59a58fa02e5c71c0a77c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/4985eb9daea2f765b6ef59a58fa02e5c71c0a77c"
},
{
"name": "https://github.com/OISF/suricata/commit/c0215c7e175b0000ef8450928dd1f3453c48379b",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/c0215c7e175b0000ef8450928dd1f3453c48379b"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8649",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8649"
}
],
"source": {
"advisory": "GHSA-ph5p-pm8r-m355",
"discovery": "UNKNOWN"
},
"title": "Suricata smtp/mime: incomplete state reset allows detection bypass"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57229",
"datePublished": "2026-09-18T20:18:38.625Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-09-18T20:18:38.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-57225 (GCVE-0-2026-57225)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:17 – Updated: 2026-09-21 18:20
VLAI
EPSS
VEX
Title
Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:20 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/pull/15699 | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/3ca2ed25a… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/bd3293aca… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8624 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-57225",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:20:30.389906Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:20:38.141Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, src/datasets-context-json.c assumes that a configured JSON or NDJSON dataset value_key resolves to a string. A trusted or untrusted dataset or rule feed containing a non-string value for that key can cause a NULL pointer dereference during startup, configuration test mode, or rule reload, crashing Suricata before traffic processing. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476: NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:17:48.513Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-vqqx-88xw-qqvc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-vqqx-88xw-qqvc"
},
{
"name": "https://github.com/OISF/suricata/pull/15699",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/pull/15699"
},
{
"name": "https://github.com/OISF/suricata/commit/3ca2ed25a324597a85a2ab11595c3b0689468ea5",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/3ca2ed25a324597a85a2ab11595c3b0689468ea5"
},
{
"name": "https://github.com/OISF/suricata/commit/bd3293aca714f5d090b73e7d9be0e5cd7e3f5f53",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/bd3293aca714f5d090b73e7d9be0e5cd7e3f5f53"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8624",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8624"
}
],
"source": {
"advisory": "GHSA-vqqx-88xw-qqvc",
"discovery": "UNKNOWN"
},
"title": "Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loading"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-57225",
"datePublished": "2026-09-18T20:17:48.513Z",
"dateReserved": "2026-06-24T02:21:33.811Z",
"dateUpdated": "2026-09-21T18:20:38.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-63452 (GCVE-0-2026-63452)
Vulnerability from cvelistv5 – Published: 2026-09-18 20:16 – Updated: 2026-09-21 18:19
VLAI
EPSS
VEX
Title
Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in rust/htp perform expensive work for every transaction, degrading packet processing and potentially causing loss of monitoring visibility or denial of service. This issue is fixed in version 8.0.6.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-21 18:19 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/OISF/suricata/security/advisor… | x_refsource_CONFIRM |
| https://github.com/OISF/suricata/commit/392b6aee2… | x_refsource_MISC |
| https://github.com/OISF/suricata/commit/e369bf29e… | x_refsource_MISC |
| https://github.com/OISF/suricata/releases/tag/sur… | x_refsource_MISC |
| https://redmine.openinfosecfoundation.org/issues/8694 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T18:19:39.620230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T18:19:52.084Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "suricata",
"vendor": "OISF",
"versions": [
{
"status": "affected",
"version": "\u003e= 8.0.0, \u003c 8.0.6"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From 8.0.0 until 8.0.6, the HTTP/1 parser limits decompression work per transaction but does not limit how many small brotli compression bombs a single flow can submit. With response-body-decompress-layer-limit enabled, repeated compressed responses make the decompression paths in rust/htp perform expensive work for every transaction, degrading packet processing and potentially causing loss of monitoring visibility or denial of service. This issue is fixed in version 8.0.6."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-18T20:16:51.951Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/OISF/suricata/security/advisories/GHSA-j9cx-w9xm-5x84",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/OISF/suricata/security/advisories/GHSA-j9cx-w9xm-5x84"
},
{
"name": "https://github.com/OISF/suricata/commit/392b6aee2971a4b5e573850f5d832112509bcb5f",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/392b6aee2971a4b5e573850f5d832112509bcb5f"
},
{
"name": "https://github.com/OISF/suricata/commit/e369bf29ee5bbd0cdf6a98dc4a3357ba43c86a88",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/commit/e369bf29ee5bbd0cdf6a98dc4a3357ba43c86a88"
},
{
"name": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/OISF/suricata/releases/tag/suricata-8.0.6"
},
{
"name": "https://redmine.openinfosecfoundation.org/issues/8694",
"tags": [
"x_refsource_MISC"
],
"url": "https://redmine.openinfosecfoundation.org/issues/8694"
}
],
"source": {
"advisory": "GHSA-j9cx-w9xm-5x84",
"discovery": "UNKNOWN"
},
"title": "Suricata http1: repeated brotli compression bombs can cause excessive CPU consumption"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63452",
"datePublished": "2026-09-18T20:16:51.951Z",
"dateReserved": "2026-07-16T19:35:57.768Z",
"dateUpdated": "2026-09-21T18:19:52.084Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}