CVE-2026-45763
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Suricata is a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain Lua allocation patterns could exceed security.lua.max-bytes without triggering the intended memory limit, making the configured sandbox limit unreliable. This requires Lua rules to be enabled and an affected Lua script/rule to be loaded.
Risk Assessment
An unreliable Lua sandbox memory limit may allow excessive memory consumption by a malicious or faulty Lua script, potentially leading to denial of service (DoS) or instability of the Suricata system.
Recommendation
Upgrade Suricata to version 8.0.5. As a workaround, disable security.lua.allow-rules unless Lua rules are required.
Other vulnerabilities in Suricata
See all- CVE-2026-22264High
Suricata before versions 8.0.3 and 7.0.14 contains an unsigned integer overflow that can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. The issue is fixed in versions 8.0.3 and 7.0.14.
- CVE-2026-22260High
Suricata, a network IDS, IPS and NSM engine, can crash with a stack overflow. The vulnerability affects versions from 8.0.0 up to 8.0.2, and version 8.0.3 patches the issue.
- CVE-2026-22259High
Suricata before versions 8.0.3 and 7.0.14 has a vulnerability to excessive memory consumption while parsing DNP3 traffic. Specially crafted traffic can slow down the process and lead to memory exhaustion, potentially causing the process to be killed by the OOM killer.
- CVE-2026-22258High
Suricata before versions 8.0.3 and 7.0.14 has a vulnerability that allows crafted DCERPC traffic to cause unbounded buffer expansion, leading to memory exhaustion and process termination. The issue affects DCERPC over UDP and likely also over TCP and SMB. Patches are available in versions 8.0.3 and 7.0.14.
- CVE-2017-15377High
In Suricata before version 4.x, it was possible to trigger many redundant checks on the content of crafted network traffic due to a bug in DetectEngineContentInspection. The search engine did not stop when no match was found, leading to exceeding the inspection recursion limit.
- CVE-2017-7177High
Suricata before version 3.2.1 has an IPv4 defragmentation evasion issue caused by lack of a check for the IP protocol during fragment matching.
- CVE-2026-94084Critical
Use-after-free vulnerability in Suricata before 8.0.7 occurs in the Http2ThreadMultiBuf mechanism when a transaction is inspected by rules using http.response_header with and without a transform.
- CVE-2026-94083Critical
In Suricata before 8.0.7, a type confusion in DoH2 can cause an invalid free because cleanup code for HTTP2 state runs even though the actual state is HTTP1 (when there is a DoH2 request with an HTTP1 to HTTP2 upgrade). This requires app-layer.protocols.doh2 to be enabled, which is default in 8.x versions.
- CVE-2026-45764Critical
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion, causing Suricata to crash and resulting in denial of service.
- CVE-2023-35853Critical
In Suricata before version 6.0.13, an adversary controlling an external source of Lua rules may be able to execute Lua code. This issue is addressed in version 6.0.13 by disabling Lua unless the allow-rules option is set to true in the Lua security configuration section.
Original NVD description (English source)
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain Lua allocation patterns could exceed `security.lua.max-bytes` without triggering the intended memory limit, making the configured sandbox limit unreliable. This requires Lua rules to be enabled and an affected Lua script/rule to be loaded. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS