CVE-2026-45759

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From version 8.0.0 to 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script or rule to be loaded.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. From version 8.0.0 to 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic may cause Suricata to consume excessive memory.

Suricata, a network IDS/IPS and security monitoring engine, prior to versions 7.0.16 and 8.0.5 allows a malicious rule to potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Workarounds include preprocessing load+save rules to disallow absolute filenames for save, using Suricata's privilege dropping to limit writable files, and/or configuring landlock in suricata.yaml.

In Suricata prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service.

In Suricata prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service.

In Suricata prior to versions 7.0.16 and 8.0.5, the IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being processed. Under crafted fragmented IPv4/IPv6 traffic, an IPv6 fragment could be associated with an IPv4 defragmentation tracker, leading to a remote packet-triggered crash and denial of service.

Suricata versions prior to 7.0.16 and 8.0.5 contain a heap buffer overflow when loading signatures. A crafted rule using mixed-case frame syntax can trigger the overflow during rule parsing/loading rather than by network traffic alone.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after it had been reallocated and freed. The issue is reached during network traffic processing, but requires a malicious rule as Suricata will crash whatever the traffic.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's inspection-buffer helper could leave an inspection pointer referencing freed memory after a chained transform caused the backing buffer to be reallocated. The issue is reached during a specific network traffic processing, and requires a specific but not malicious rule.