Suricata CVE-2026-31931

Suricata versions 8.0.0-8.0.3 with detection rules using the 'tls.alpn' keyword. Remote unauthenticated attacker sends crafted TLS traffic matching the rule, causing NULL dereference denial of service. No victim interaction required.

Real-world risk is moderate-to-high for organizations using affected Suricata versions in production security infrastructure. The CVSS v3.1 score of 7.5 (High) reflects the severe availability impact, with the attack vector being network-accessible (AV:N), low complexity (AC:L), and requiring no authentication (PR:N) or user interaction (UI:N). However, the impact is limited to denial of service with no confidentiality or integrity compromise (C:N/I:N/A:H). While no EPSS score is provided, the combination of trivial exploitation requirements and critical infrastructure positioning of IDS/IPS systems elevates concern. The vulnerability is NOT listed in CISA's KEV catalog, indicating no confirmed active exploitation in the wild. No public proof-of-concept code is identified in references, reducing immediate weaponization risk. From an SSVC decision framework perspective: exploitation status is 'none' (no POC/KEV), automatable is 'yes' (network-based with low complexity), technical impact is 'partial' (availability only). This suggests prioritized but not emergency patching. The primary risk is operational: an attacker who knows the vulnerability can selectively disable network monitoring by targeting Suricata sensors, potentially as a precursor to further attacks that would otherwise be detected. Organizations using 'tls.alpn' rules in production should prioritize upgrading, while those not utilizing this keyword face lower immediate risk.

A remote attacker identifies an organization's network perimeter protected by Suricata 8.0.x configured with IPS mode and TLS inspection rules. The attacker crafts malformed TLS ClientHello packets with specially structured ALPN extension data designed to trigger the NULL dereference when processed by Suricata's 'tls.alpn' rule matching engine. By sending these packets to any monitored network interface, the attacker causes Suricata to crash immediately, disabling all intrusion prevention and detection capabilities. With network security monitoring offline, the attacker proceeds with subsequent malicious activities (lateral movement, data exfiltration, malware deployment) that would normally be detected and blocked, effectively blinding the security infrastructure. The low attack complexity means automated exploitation tools could be developed to systematically disable Suricata sensors across multiple targets.