Suricata, a network IDS/IPS and monitoring engine, has a heap-based buffer overflow vulnerability identified as CVE-2026-63451. The vulnerability arises from the handling of detection rules that combine frame inspection without content and transformed matches without content, which causes the detect-engine-prefilter component to select multiple non-prefilter frame engines incorrectly. Loading such a crafted rule, even in test mode, can trigger the overflow and crash the application. Network traffic alone cannot exploit this flaw. The vulnerability affects Suricata versions from 8.0.0 up to but not including 8.0.6, where it has been fixed.

The vulnerability can cause Suricata to crash due to a heap buffer overflow when processing a specially crafted detection rule supplied locally. There is no confidentiality or integrity impact, and the flaw cannot be triggered remotely via network traffic. The impact is limited to denial of service on the affected system.

Upgrade Suricata to version 8.0.6 or later, where this vulnerability is fixed. Since the flaw requires a locally supplied crafted detection rule to trigger, avoid loading untrusted detection rules. No network-based exploitation is possible.