CVE-2026-45752 is a use-after-free vulnerability (CWE-416) in the Suricata network security engine affecting versions >=8.0.0 and <8.0.5. The issue occurs in the decompress transform pipeline when detection transforms such as 'gunzip' or 'zlib_deflate' are chained with a max-size parameter exceeding 4096 after another transform. This leads to reading from an inspection buffer after it has been freed and reallocated, causing a crash during network traffic processing. Exploitation requires a malicious rule, not just malicious traffic. The vulnerability is fixed in Suricata version 8.0.5.

The vulnerability causes Suricata to crash (denial of service) when processing network traffic with specific malicious detection rules. There is no impact on confidentiality or integrity reported. No known exploits are in the wild. The attack complexity is high due to the need for a crafted rule. The CVSS score is 5.9 (medium severity) reflecting a network attack vector with high attack complexity and no privileges or user interaction required.

Upgrade Suricata to version 8.0.5 or later, which contains an official fix for this use-after-free vulnerability. As a temporary workaround, avoid using detection rules that chain 'gunzip' or 'zlib_deflate' transforms with a max-size greater than 4096 after another transform until the update is applied.