Suricata CVE-2026-45752

Exploitation requires the ability to introduce a malicious Suricata detection rule into the running rule set - this means administrative access to the Suricata rules directory, a compromised rule-distribution channel, or write access to a shared rule repository. The rule must specifically chain gunzip or zlib_deflate transforms with a max-size parameter greater than 4096 bytes positioned after at least one other transform in the detection pipeline. Once such a rule is loaded, any network traffic processed by Suricata triggers the crash - no special traffic crafting is required. Deployments limited to Suricata 7.x are not affected. Deployments that restrict rule authorship exclusively to trusted administrators and verify rule-feed integrity substantially limit exposure.

The CVSS 3.1 score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) is partially accurate but requires scrutiny on the PR metric. The description explicitly states that a malicious rule must be present - rule authorship in Suricata requires administrative access to the rule pipeline, making pure PR:N misleading. In practice, the realistic attacker is an admin or a compromised rule-distribution channel (e.g., a poisoned Emerging Threats feed or a misconfigured shared rule repository). AC:H correctly reflects the specific transform-chaining constraint. Impact is limited to availability - no code execution, no data exfiltration - making this a medium-severity availability concern rather than a critical risk. EPSS data is not provided in the input. KEV status is negative. No POC is publicly confirmed. Even a mid-sized municipal security operation in opole running Suricata 8.0.x with third-party rule subscriptions should treat this as a targeted availability risk rather than a broad exploitation concern - prioritize patching if on 8.0.x and verify rule-source integrity in the interim. Deployments on Suricata 7.x are not affected per the description.

An attacker with write access to Suricata's rule set - or the ability to inject rules via a compromised or untrusted rule feed - crafts a rule that chains a gunzip or zlib_deflate transform with a max-size parameter above 4096 bytes immediately following another transform. Once this rule is loaded and Suricata begins processing live network traffic, the decompress pipeline dereferences the freed inspection buffer, immediately crashing the Suricata process and disabling network intrusion detection or prevention for the affected segment. No specific traffic content is required to trigger the crash once the malicious rule is active.