Suricata, a network intrusion detection and prevention system, has a vulnerability (CVE-2026-57229) in its SMTP MIME parser implemented in rust/src/mime/smtp.rs. Between versions 8.0.0 and 8.0.5 inclusive, the parser fails to fully reset its internal state when handling Content-Type: message/rfc822 encapsulated MIME parts. This improper initialization (CWE-665) can cause state leakage of encoding or filename attributes from an outer MIME part into the inner message. As a result, crafted emails can bypass detection mechanisms that rely on file data, file names, or extracted URLs. The vulnerability has a CVSS 3.1 base score of 5.3 (medium severity) and was fixed in version 8.0.6.

The vulnerability allows an attacker to craft SMTP MIME messages that evade detection by Suricata's file data, filename, or URL extraction detection rules when SMTP MIME decoding is enabled. This can reduce the effectiveness of Suricata's network security monitoring and intrusion detection capabilities, potentially allowing malicious payloads or URLs to pass unnoticed. There is no impact on confidentiality or availability reported, and no known exploits in the wild.

Upgrade Suricata to version 8.0.6 or later, where this vulnerability has been fixed. The fix ensures the SMTP MIME parser fully resets its state when processing Content-Type: message/rfc822 encapsulated messages, preventing state leakage and detection evasion. No other mitigation is indicated or required.