What is the CVSS score of CVE-2026-22259?

CVE-2026-22259 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Suricata are affected by CVE-2026-22259?

Suricata versions prior to 8.0.3 and 7.0.14 are vulnerable to a denial-of-service attack via maliciously crafted DNP3 network traffic, which can cause memory exhaustion and service disruption.. A patch is available.

How to fix or mitigate CVE-2026-22259?

Within 24 hours: Identify all Suricata deployments and document current versions. Within 7 days: Prioritize patching to versions 8.0.3, 7.0.14, or later; test patches in non-production environments first. Within 30 days: Complete patching of all production Suricata instances and validate DNP3 traffic monitoring functionality post-deployment.

Suricata CVE-2026-22259

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-01-27 security-advisories@github.com

Denial Of Service Suricata Suse Oisf

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Jan 30, 2026 - 20:01 nvd

Patch available

CVE Published

Jan 27, 2026 - 17:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP3 traffic. This can lead to the process slowing down and running out of memory, potentially leading to it getting killed by the OOM killer. Versions 8.0.3 or 7.0.14 contain a patch. As a workaround, disable the DNP3 parser in the suricata yaml (disabled by default).

AnalysisAI

Suricata versions prior to 8.0.3 and 7.0.14 are vulnerable to a denial of service condition where specially crafted DNP3 traffic triggers excessive memory consumption, potentially exhausting system memory and causing the service to crash. An unauthenticated attacker on the network can exploit this by sending malicious DNP3 packets to cause the IDS/IPS engine to become unavailable. A patch is available in the latest versions, and users can mitigate the risk by disabling the DNP3 parser if not required.

Technical ContextAI

Classified as CWE-400 (Uncontrolled Resource Consumption). Affects Suricata. Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP3 traffic. This can lead to the process slowing down and running out of memory, potentially leading to it getting killed by the OOM killer. Versions 8.0.3 or 7.0.14 contain a patch. As a workaround, disable the DNP3 parser in the suricata yaml (disabled by default).