What is the CVSS score of CVE-2026-45766?

CVE-2026-45766 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.4%.

Which versions of Suricata are affected by CVE-2026-45766?

Suricata security monitoring systems can be crashed remotely by attackers without credentials, disabling your organization's real-time threat detection capabilities and creating a critical…. A patch is available.

How to fix or mitigate CVE-2026-45766?

Within 24 hours, identify all Suricata installations using 'suricata -V' and document affected versions. Within 7 days, and given no vendor-released patch has been identified at time of analysis, implement network-level filtering to restrict NFS traffic from untrusted sources, enable continuous memory utilization monitoring on Suricata processes with high-threshold alerting, and assess feasibility of disabling NFS protocol inspection if not operationally critical. Within 30 days, monitor OISF advisories for release of patched versions (7.0.16 for stable branch, 8.0.5 for current release), and deploy patches to all systems immediately upon availability.

Suricata CVE-2026-45766

EUVD-2026-75767 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-09-10 GitHub_M

Denial Of Service Suricata Oisf

7.5

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable via monitored traffic requiring no authentication; purely availability impact with no confidentiality or integrity consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

POC Analysis Generated

Sep 10, 2026 - 23:21 vuln.today

Patch available

Sep 10, 2026 - 23:03 EUVD

Analysis Generated

Sep 10, 2026 - 22:30 vuln.today

CVE Published

Sep 10, 2026 - 21:26 cve.org

HIGH 7.5

DescriptionCVE.org

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.

AnalysisAI

Memory exhaustion in Suricata's NFS application-layer parser allows remote unauthenticated attackers to crash or severely degrade the IDS/IPS/NSM engine by sending crafted NFS traffic. Affected versions span all releases prior to 7.0.16 and 8.0.5, covering both the stable and current release branches maintained by OISF. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Recon

technique details hidden

Delivery

technique details hidden

Exploit

technique details hidden

Install

technique details hidden

Execute

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Suricata must have NFS application-layer parsing enabled, which is the default when NFS traffic is present on a monitored interface and the app-layer NFS decoder is not explicitly disabled in suricata.yaml. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the zero-authentication, low-complexity network reachability of this flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	Vendor-released patches are available: upgrade to Suricata 7.0.16 (stable branch) or 8.0.5 (current branch) as documented at https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315. … Detailed patch versions, workarounds, and compensating controls in full report.