Suricata: 15 Vulnerabilities Disclosed, Ranging from Critical to Low
Oisf disclosed 15 Suricata vulnerabilities on September 10, 2026, including a Critical flaw, stemming from parser and state management issues.
Key findings
- 15 Suricata vulnerabilities disclosed on September 10, 2026, ranging from Low to Critical severity.
- Multiple CVEs stem from unbounded state growth and buffer handling issues in various protocol parsers.
- Critical flaw CVE-2026-45764 involves HTTP/2 type confusion leading to potential crashes.
- Vulnerabilities affect rule processing, Lua sandbox, and memory management components.
- All issues are fixed in Suricata versions 7.0.16 and 8.0.5.
On September 10, 2026, Oisf disclosed a batch of 15 vulnerabilities affecting the Suricata network intrusion detection system. The vulnerabilities, disclosed within an 8-hour window, range in severity from Low to Critical, with a significant number rated as High. These flaws primarily stem from insufficient bounds checking in various protocol parsers and state management components, potentially leading to memory exhaustion, crashes, or even arbitrary file overwrites.
Several vulnerabilities are related to unbounded state growth or buffer handling within specific protocol parsers. CVE-2026-45769 highlights an issue in the IKEv2 parser where state could grow without bounds, leading to excessive memory consumption. Similarly, CVE-2026-45768 points to an unbounded number of responses in the LDAP parser, also posing a memory exhaustion risk. The NFS parser is affected by CVE-2026-45765, where insufficient bounds could lead to denial of service. The DNP3 parser in CVE-2026-45766 also suffers from similar unbounded buffering issues. Furthermore, CVE-2026-45763 and CVE-2026-45751 describe problems with Suricata's HTTP/2 decompression and inspection-buffer handling, respectively, which could lead to memory exhaustion or use-after-free vulnerabilities.
Other vulnerabilities target Suricata's rule processing and Lua scripting capabilities. CVE-2026-45761 describes a heap buffer overflow triggered by a crafted rule with mixed-case frame syntax during signature loading. CVE-2026-45770 and CVE-2026-45763 indicate that a Lua rule registering too many flow variables or certain Lua allocation patterns could bypass the sandbox and consume excessive memory or lead to state corruption. CVE-2026-45752 involves a potential use-after-reallocation in the decompress transform pipeline when detection transforms are chained. CVE-2026-45747 details a NULL dereference in the Lua TLS certificate information helper when requesting information for TLS traffic with incomplete certificate fields.
A critical vulnerability, CVE-2026-45764, arises from a protocol change during HTTP/2 traffic processing, leading to a type confusion that could crash Suricata. CVE-2026-45762 addresses an issue in IP defragmentation where the tracker lookup did not verify the IP address family, potentially leading to exploitation under crafted fragmented packets. CVE-2026-45759 points to performance issues where Suricata could repeatedly parse large HTTP Content-Disposition headers, leading to denial of service under crafted HTTP traffic. Finally, CVE-2026-45767, a medium severity flaw, could allow a malicious rule to overwrite any file on the filesystem during rule load or reload.
All disclosed vulnerabilities are addressed in Suricata versions 7.0.16 and 8.0.5. For versions prior to 7.0.16 and 8.0.5, users are advised to update immediately. Workarounds for CVE-2026-45767 are mentioned as available, but specific details were not provided in the disclosure.
This batch of vulnerabilities underscores the importance of diligent parsing and state management in network security monitoring tools. Users of Suricata should prioritize updating to the patched versions to mitigate risks ranging from denial of service to potential arbitrary file overwrites and sandbox escapes. The wide range of affected components highlights the complexity of Suricata's architecture and the need for continuous security auditing.
The disclosed CVEs are: CVE-2026-45770, CVE-2026-45769, CVE-2026-45768, CVE-2026-45767, CVE-2026-45766, CVE-2026-45765, CVE-2026-45764, CVE-2026-45762, CVE-2026-45761, CVE-2026-45759, CVE-2026-45752, CVE-2026-45751, CVE-2026-46387, CVE-2026-45747, CVE-2026-45763.