Suricata CVE-2026-31937

Remote unauthenticated attacker must send DCERPC traffic through network monitored by vulnerable Suricata versions prior to 7.0.15. No special configuration required; default Suricata installations with DCERPC protocol inspection enabled are affected.

While the CVSS base score of 7.5 (High) reflects the network accessibility (AV:N), low attack complexity (AC:L), and lack of authentication requirements (PR:N), the real-world risk is nuanced. The attack causes high availability impact (A:H) specifically to the monitoring function rather than protected assets directly. No confidentiality or integrity impact exists (C:N/I:N), meaning this does not compromise data directly but rather the security control itself. The absence of KEV listing and public exploit code suggests this is not yet being actively exploited in the wild. However, for organizations relying on Suricata as a critical security control, this represents a significant blind-spot vulnerability where attackers could degrade detection capabilities before launching subsequent attacks. The ease of exploitation (unauthenticated network access, low complexity) combined with the strategic value of disabling security monitoring makes this a priority for organizations running affected Suricata versions, particularly in environments where DCERPC traffic is common (Windows-heavy networks). The vulnerability is automatable and has clear technical impact on security operations, warranting prompt remediation despite the lack of observed exploitation.

An attacker targeting a network protected by Suricata could craft malicious DCERPC packets designed to trigger the inefficient buffering behavior, sending these packets at moderate volume to the monitored network segments. As Suricata processes this traffic, the algorithmic inefficiency causes CPU and memory resource exhaustion, degrading the engine's packet inspection throughput. During this performance degradation period, the attacker launches their primary attack-such as data exfiltration, lateral movement, or malware delivery-knowing that Suricata's detection capabilities are impaired and unable to process traffic at normal rates. This technique is particularly effective because the resource exhaustion attack requires no authentication and has low complexity, making it trivial to execute from any network position that Suricata monitors, effectively weaponizing the security control against itself.