What is the CVSS score of CVE-2026-22264?

CVE-2026-22264 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Suricata are affected by CVE-2026-22264?

A high-severity vulnerability in Suricata versions prior to 8.0.3 and 7.0.14 could allow attackers to crash or compromise network monitoring systems through specially crafted packets that generate…. A patch is available.

How to fix or mitigate CVE-2026-22264?

Within 24 hours: Verify Suricata version across all deployed instances and identify systems running versions prior to 8.0.3 or 7.0.14. Within 7 days: Apply vendor patches to all affected Suricata installations, prioritizing production IDS/IPS systems. Within 30 days: Validate patch deployment through testing and update asset inventory to confirm all systems are current.

Suricata CVE-2026-22264

HIGH

Use After Free (CWE-416)

2026-01-27 security-advisories@github.com

Use After Free Integer Overflow Suricata Suse

7.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.4 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

Patch released

Jan 29, 2026 - 20:58 nvd

Patch available

CVE Published

Jan 27, 2026 - 19:16 nvd

HIGH 7.4

DescriptionGitHub Advisory

Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not run untrusted rulesets or run with less than 65536 signatures that can match on the same packet.

AnalysisAI

Heap use-after-free in Suricata prior to versions 8.0.3 and 7.0.14 can be triggered via integer overflow when processing packets that generate excessive alert conditions, allowing an attacker to crash the IDS/IPS engine or potentially achieve code execution. Affected deployments using large rulesets are at risk when processing malicious or crafted network traffic designed to trigger simultaneous signature matches. Patches are available for both affected versions.

Technical ContextAI

Classified as CWE-416 (Use After Free). Affects Suricata. Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not run untrusted rulesets or run with less than 65536 signatures that can match on the same packet.