CVE-2026-57226: CWE-122: Heap-based Buffer Overflow in OISF suricata
CVE-2026-57226 is a heap-based buffer overflow vulnerability in Suricata, a network intrusion detection and prevention system. The flaw occurs in HTTP SWF decompression when using the non-default swf-decompression feature with an unsafe decompress-depth configuration. This can cause Suricata to allocate memory based on the configured depth rather than the actual Flash file data size, leading to a heap buffer overflow and potential crash. The vulnerability affects versions prior to 7.0.17 and 8.0.6. The default configuration is not affected. The issue has been fixed in Suricata versions 7.0.17 and 8.0.6.
AI Analysis
Technical Summary
Suricata versions before 7.0.17 and 8.0.6 contain a heap-based buffer overflow vulnerability in the HTTP SWF decompression code when the swf-decompression feature is enabled with an unsafe decompress-depth setting. The vulnerability arises because the allocation size is based on the configured decompress-depth rather than the actual size of the Flash file data, allowing a crafted SWF response to trigger an integer-related heap buffer overflow. This can cause Suricata to crash. The default disabled feature and default decompress-depth are not affected. The vulnerability is addressed by limiting the allocation to the Flash file's actual data requirement in versions 7.0.17 and 8.0.6.
Potential Impact
The vulnerability can cause Suricata to crash due to a heap-based buffer overflow when processing crafted SWF HTTP responses under specific non-default configurations. There is no impact on confidentiality or integrity, and no known exploits in the wild. The default configuration is not vulnerable.
Mitigation Recommendations
This vulnerability is fixed in Suricata versions 7.0.17 and 8.0.6. Users should upgrade to one of these versions or later to remediate the issue. The default configuration, which disables the swf-decompression feature and uses the default decompress-depth, is not affected. If upgrading is not immediately possible, ensure the swf-decompression feature is disabled or the decompress-depth is set safely.
CVE-2026-57226: CWE-122: Heap-based Buffer Overflow in OISF suricata
Description
CVE-2026-57226 is a heap-based buffer overflow vulnerability in Suricata, a network intrusion detection and prevention system. The flaw occurs in HTTP SWF decompression when using the non-default swf-decompression feature with an unsafe decompress-depth configuration. This can cause Suricata to allocate memory based on the configured depth rather than the actual Flash file data size, leading to a heap buffer overflow and potential crash. The vulnerability affects versions prior to 7.0.17 and 8.0.6. The default configuration is not affected. The issue has been fixed in Suricata versions 7.0.17 and 8.0.6.
CVSS v3.1
Score 3.7low
Affected software
OISF
suricata
pkg:github/oisf/suricataRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Suricata versions before 7.0.17 and 8.0.6 contain a heap-based buffer overflow vulnerability in the HTTP SWF decompression code when the swf-decompression feature is enabled with an unsafe decompress-depth setting. The vulnerability arises because the allocation size is based on the configured decompress-depth rather than the actual size of the Flash file data, allowing a crafted SWF response to trigger an integer-related heap buffer overflow. This can cause Suricata to crash. The default disabled feature and default decompress-depth are not affected. The vulnerability is addressed by limiting the allocation to the Flash file's actual data requirement in versions 7.0.17 and 8.0.6.
Potential Impact
The vulnerability can cause Suricata to crash due to a heap-based buffer overflow when processing crafted SWF HTTP responses under specific non-default configurations. There is no impact on confidentiality or integrity, and no known exploits in the wild. The default configuration is not vulnerable.
Mitigation Recommendations
This vulnerability is fixed in Suricata versions 7.0.17 and 8.0.6. Users should upgrade to one of these versions or later to remediate the issue. The default configuration, which disables the swf-decompression feature and uses the default decompress-depth, is not affected. If upgrading is not immediately possible, ensure the swf-decompression feature is disabled or the decompress-depth is set safely.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-24T02:21:33.811Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad9c4155bf5e2cf5802952
Added to database: 09/18/2026, 20:17:05 UTC
Last enriched: 09/18/2026, 20:32:12 UTC
Last updated: 09/18/2026, 20:32:12 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.