CVE-2026-22258
HighSummary
Suricata before versions 8.0.3 and 7.0.14 has a vulnerability that allows crafted DCERPC traffic to cause unbounded buffer expansion, leading to memory exhaustion and process termination. The issue affects DCERPC over UDP and likely also over TCP and SMB. Patches are available in versions 8.0.3 and 7.0.14.
Risk Assessment
An attacker can remotely crash the IDS/IPS engine, resulting in loss of network protection and potential service disruption.
Recommendation
Upgrade Suricata to version 8.0.3 or 7.0.14. If not possible, disable the DCERPC/UDP parser and limit stream reassembly depth for DCERPC/TCP and SMB.
Other vulnerabilities in Suricata
See all- CVE-2026-22264High
Suricata before versions 8.0.3 and 7.0.14 contains an unsigned integer overflow that can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. The issue is fixed in versions 8.0.3 and 7.0.14.
- CVE-2026-22260High
Suricata, a network IDS, IPS and NSM engine, can crash with a stack overflow. The vulnerability affects versions from 8.0.0 up to 8.0.2, and version 8.0.3 patches the issue.
- CVE-2026-22259High
Suricata before versions 8.0.3 and 7.0.14 has a vulnerability to excessive memory consumption while parsing DNP3 traffic. Specially crafted traffic can slow down the process and lead to memory exhaustion, potentially causing the process to be killed by the OOM killer.
- CVE-2017-15377High
In Suricata before version 4.x, it was possible to trigger many redundant checks on the content of crafted network traffic due to a bug in DetectEngineContentInspection. The search engine did not stop when no match was found, leading to exceeding the inspection recursion limit.
- CVE-2017-7177High
Suricata before version 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching.
- CVE-2023-35853Critical
In Suricata before version 6.0.13, an adversary controlling an external source of Lua rules may be able to execute Lua code. This issue is addressed in version 6.0.13 by disabling Lua unless the allow-rules option is set to true in the Lua security configuration section.
- CVE-2015-8954Critical
The MemcmpLowercase function in Suricata before version 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attackers to bypass intrusion-prevention functionality via a crafted HTTP request.
- CVE-2026-59674High
A vulnerability in the suricata package for openSUSE Tumbleweed allows the suricata user to escalate privileges to root by following a UNIX symbolic link.
- CVE-2023-35852High
In Suricata before version 6.0.13, an adversary controlling an external source of rules may exploit a dataset filename to trigger directory traversal, leading to write access to the local filesystem. This issue is addressed in version 6.0.13 by requiring the use of allow-absolute-filenames and allow-write options in the datasets rules configuration section.
Original NVD description (English source)
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB are also vulnerable. DCERPC/TCP in the default configuration should not be vulnerable as the default stream depth is limited to 1MiB. Versions 8.0.3 and 7.0.14 contain a patch. Some workarounds are available. For DCERPC/UDP, disable the parser. For DCERPC/TCP, the `stream.reassembly.depth` setting will limit the amount of data that can be buffered. For DCERPC/SMB, the `stream.reassembly.depth` can be used as well, but is set to unlimited by default. Imposing a limit here may lead to loss of visibility in SMB.