CVE-2026-45765: CWE-400: Uncontrolled Resource Consumption in OISF suricata
CVE-2026-45765 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. The issue involves uncontrolled resource consumption due to insufficient bounds checking in the DNP3 protocol reassembly. Specifically, crafted DNP3 traffic can cause Suricata to buffer excessive data, leading to high memory usage and potential denial of service. This vulnerability affects Suricata versions prior to 7.0.16 and versions from 8.0.0 up to but not including 8.0.5. Fixed versions 7.0.16 and 8.0.5 address this issue. As a workaround, disabling DNP3 if unused or limiting stream reassembly depth can mitigate the risk.
AI Analysis
Technical Summary
Suricata versions <7.0.16 and >=8.0.0 <8.0.5 have a vulnerability in the DNP3 reassembly component where data buffering lacks sufficient parser-level bounds. This can lead to uncontrolled resource consumption (memory exhaustion) when processing crafted DNP3 traffic, resulting in denial of service. The issue is tracked as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). Official fixes are included in versions 7.0.16 and 8.0.5. Workarounds include disabling DNP3 protocol support (disabled by default) or setting a limited stream reassembly depth.
Potential Impact
An attacker can send specially crafted DNP3 traffic to Suricata instances running vulnerable versions, causing excessive memory consumption. This may lead to denial of service by exhausting system resources. There is no impact on confidentiality or integrity reported. The vulnerability is exploitable remotely without authentication.
Mitigation Recommendations
Upgrade Suricata to version 7.0.16 or 8.0.5 or later to apply the official fix. If upgrading is not immediately possible, disable DNP3 protocol support if it is not required, as it is disabled by default. Alternatively, configure the 'stream.reassembly.depth' parameter to a limited value (non-zero) to restrict memory usage during reassembly. These mitigations reduce the risk of denial of service from crafted DNP3 traffic.
CVE-2026-45765: CWE-400: Uncontrolled Resource Consumption in OISF suricata
Description
CVE-2026-45765 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. The issue involves uncontrolled resource consumption due to insufficient bounds checking in the DNP3 protocol reassembly. Specifically, crafted DNP3 traffic can cause Suricata to buffer excessive data, leading to high memory usage and potential denial of service. This vulnerability affects Suricata versions prior to 7.0.16 and versions from 8.0.0 up to but not including 8.0.5. Fixed versions 7.0.16 and 8.0.5 address this issue. As a workaround, disabling DNP3 if unused or limiting stream reassembly depth can mitigate the risk.
CVSS v3.1
Score 7.5high
Affected software
OISF
suricata
pkg:github/oisf/suricataRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Suricata versions <7.0.16 and >=8.0.0 <8.0.5 have a vulnerability in the DNP3 reassembly component where data buffering lacks sufficient parser-level bounds. This can lead to uncontrolled resource consumption (memory exhaustion) when processing crafted DNP3 traffic, resulting in denial of service. The issue is tracked as CWE-400 (Uncontrolled Resource Consumption) and CWE-770 (Allocation of Resources Without Limits or Throttling). Official fixes are included in versions 7.0.16 and 8.0.5. Workarounds include disabling DNP3 protocol support (disabled by default) or setting a limited stream reassembly depth.
Potential Impact
An attacker can send specially crafted DNP3 traffic to Suricata instances running vulnerable versions, causing excessive memory consumption. This may lead to denial of service by exhausting system resources. There is no impact on confidentiality or integrity reported. The vulnerability is exploitable remotely without authentication.
Mitigation Recommendations
Upgrade Suricata to version 7.0.16 or 8.0.5 or later to apply the official fix. If upgrading is not immediately possible, disable DNP3 protocol support if it is not required, as it is disabled by default. Alternatively, configure the 'stream.reassembly.depth' parameter to a limited value (non-zero) to restrict memory usage during reassembly. These mitigations reduce the risk of denial of service from crafted DNP3 traffic.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-13T07:45:21.250Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa32b5891cc7f3848d53ffd
Added to database: 09/10/2026, 22:12:40 UTC
Last enriched: 09/10/2026, 22:18:03 UTC
Last updated: 09/11/2026, 03:05:13 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.