Threats affecting pkg:github/oisf/suricata

CVE-2026-45769 is a high-severity vulnerability in the Suricata network security engine affecting versions prior to 7.0.16 and between 8.0.0 and before 8.0.5. The issue involves uncontrolled resource consumption due to the IKEv2 parser state growing without bounds when storing client transforms. This can lead to excessive memory use and potential denial of service. The vulnerability is fixed in Suricata versions 7.0.16 and 8.0.5. Mitigations include disabling IKE application-layer parsing if not needed or using a rule to bypass IKE flows after a certain number of packets.

CVE-2026-45768 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. Versions from 8.0.0 up to but not including 8.0.5 are affected. The issue involves uncontrolled resource consumption due to LDAP transaction state storing an unbounded number of responses, which can lead to excessive memory use and potential denial of service. The vulnerability arises because LDAP can be processed over UDP, allowing crafted traffic to trigger this condition. Version 8.0.5 includes a fix for this problem. As a mitigation, disabling LDAP application-layer parsing when not needed or using a detection rule to alert on excessive LDAP responses is recommended.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could potentially overwrite any file on the file system on rule load or reload. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Preprocess `load`+ `save` rules to disallow absolute filenames for save, use Suricata's privilege dropping to limit writable files, and/or configure landlock in suricata.yaml.

CVE-2026-45766 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. Versions prior to 7.0.16 and 8.0.5 have insufficient bounds on certain NFS parser state structures. This flaw allows crafted NFS traffic to cause excessive memory consumption, potentially leading to denial of service. Fixed in versions 7.0.16 and 8.0.5. Disabling NFS application-layer parsing is a recommended workaround if that functionality is not required.

CVE-2026-45765 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. Prior to versions 7.0.16 and 8.0.5, Suricata's DNP3 protocol reassembly could consume excessive memory due to insufficient parser-level bounds, potentially leading to denial of service. The issue is fixed in versions 7.0.16 and 8.0.5. As a mitigation, users can disable DNP3 if not needed or limit the stream reassembly depth.

CVE-2026-45764 is a critical vulnerability in Suricata, a network intrusion detection and prevention system. The flaw involves a type confusion issue triggered by a protocol change while processing HTTP/2 traffic. This can cause Suricata to crash, resulting in a denial of service. Versions prior to 7.0.16 and 8.0.5 are affected. Fixed versions 7.0.16 and 8.0.5 address this issue. Disabling HTTP/2 parsing is a recommended workaround if that functionality is not needed.

CVE-2026-45762 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. The flaw involves a type confusion in the IP defragmentation tracker lookup, where fragmented IPv6 packets could be incorrectly associated with IPv4 trackers. This mismatch can cause Suricata to crash and result in a denial of service. The issue affects Suricata versions prior to 7.0.16 and versions from 8.0.0 up to but not including 8.0.5. Fixed versions 7.0.16 and 8.0.5 address this vulnerability. A workaround for IDS deployments using AF_PACKET is to enable the AF_PACKET defrag option to prevent Suricata from processing problematic fragmented packets.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached during rule parsing/loading rather than by network traffic alone. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, preprocess rules to check that frames are all lowercase and/or only load trusted rulesets.

CVE-2026-45759 is a high-severity vulnerability in Suricata, a network intrusion detection and prevention system. Prior to versions 7.0.16 and 8.0.5, Suricata could be forced to repeatedly parse large HTTP Content-Disposition headers during HTTP response processing, leading to excessive CPU usage and denial of service. This uncontrolled resource consumption issue is fixed in versions 7.0.16 and 8.0.5. A workaround involves using a specific Suricata rule to detect and bypass large Content-Disposition headers.

CVE-2026-45752 is a use-after-free vulnerability in Suricata versions 8.0.0 up to but not including 8.0.5. It occurs when certain detection transforms are chained, causing the decompress transform pipeline to read from a buffer after it has been freed. This flaw can cause Suricata to crash during network traffic processing if a malicious rule triggers it. Version 8.0.5 includes a fix for this issue. A temporary workaround is to avoid rules chaining 'gunzip' or 'zlib_deflate' with a max-size greater than 4096 after another transform.

CVE-2026-45751 is a use-after-free vulnerability in Suricata's inspection-buffer helper that affects versions prior to 7.0.16 and between 8.0.0 and 8.0.5. The issue occurs when a chained transform causes the backing buffer to be reallocated, leaving an inspection pointer referencing freed memory. This vulnerability requires a specific network traffic processing scenario and a particular but non-malicious rule involving the 'dotprefix' transform. Versions 7.0.16 and 8.0.5 include a fix for this issue. A workaround is to avoid chaining the 'dotprefix' transform after another transform.

CVE-2026-45747 is a high-severity vulnerability in Suricata prior to version 7.0.16. It involves a NULL pointer dereference in the Lua TLS certificate information helper when Lua scripts request certificate data for TLS traffic missing some certificate fields. This can cause Suricata to crash, resulting in a denial of service. The issue is fixed in version 7.0.16. Workarounds include avoiding Lua scripts that call the TLS certificate information helper on untrusted traffic or updating scripts to handle missing certificate fields.

CVE-2026-45763 is a vulnerability in Suricata versions 8.0.0 through 8.0.4 where the Lua sandbox memory limit was not consistently enforced. This flaw allows certain Lua allocation patterns to exceed the configured memory limit, potentially causing resource exhaustion. The issue requires Lua rule execution to be enabled and an affected Lua script or rule to be loaded. The vulnerability is fixed in version 8.0.5. A workaround is to disable Lua rules unless they are required.

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's HTTP/2 decompression path could grow the decompressed response-body buffer without an effective upper bound. A crafted HTTP/2 DATA payload using a high compression ratio, such as gzip, deflate, or brotli compressed data, could cause Suricata to allocate excessive memory while decompressing the payload. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP2.

Suricata is a network IDS, IPS and NSM engine. Prior to version 7.0.15, inefficiency in DCERPC buffering can lead to a performance degradation. This issue has been patched in version 7.0.15.

CVE-2026-31935 is a high-severity vulnerability in the OISF Suricata network IDS/IPS/NSM engine. It involves uncontrolled resource consumption caused by flooding crafted HTTP2 continuation frames, which can exhaust memory and typically cause the Suricata process to be terminated by the operating system. This issue affects Suricata versions prior to 7.0.15 and versions from 8.0.0 up to but not including 8.0.4. The vulnerability has been patched in versions 7.

CVE-2026-31934 is a vulnerability in OISF Suricata versions 8.0.0 through 8.0.3 where a quadratic algorithmic complexity issue occurs when searching for URLs in MIME encoded SMTP messages. This leads to a significant performance degradation. The issue has been addressed and patched in version 8.0.4.

Suricata is a network IDS, IPS and NSM engine. Prior to versions 7.0.15 and 8.0.4, specially crafted traffic can cause Suricata to slow down, affecting performance in IDS mode. This issue has been patched in versions 7.0.15 and 8.0.4.

CVE-2026-31932 is a high-severity vulnerability in OISF Suricata, a network IDS/IPS/NSM engine. It involves inefficient algorithmic complexity in the KRB5 buffering process, leading to potential performance degradation. This issue affects Suricata versions prior to 7.0.15 and versions from 8.0.0 up to but not including 8.0.4. The vulnerability has been addressed in versions 7.

A NULL pointer dereference vulnerability exists in Suricata versions 8.0.0 through 8.0.3 when using the "tls.alpn" rule keyword, which can cause the application to crash. This issue has been fixed in version 8.0.4. The vulnerability has a high severity rating with a CVSS score of 7.