Suricata CVE-2026-45770

Exploitation requires two specific non-default conditions to both be true simultaneously. First, security.lua.allow-rules must be explicitly enabled in the Suricata configuration - this is not enabled by default. Second, a crafted or malicious Lua rule that registers an excessive number of flow variables must be present in Suricata's active rule set; loading this rule requires either direct administrative access to the Suricata rules file directory or compromise of an upstream rules distribution channel that the operator has configured Suricata to pull from automatically. Exploitation is limited to Suricata 8.0.0-8.0.4; version 8.0.5 and later are unaffected. The 7.x branch is not mentioned as vulnerable. Non-Lua detection rules are unaffected by this vulnerability.

The provided CVSS 7.5 score (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) warrants scrutiny against actual exploitation conditions. The PR:N metric reflects that no runtime authentication challenge exists once a malicious Lua rule is already loaded, but it obscures the effective access barrier of getting that rule into Suricata's configuration in the first place - whether via direct admin access or compromise of a rules distribution feed. AC:L similarly understates the non-default configuration requirement (security.lua.allow-rules must be enabled and a crafted rule loaded), which is a meaningful constraint. Furthermore, A:N directly conflicts with the description's explicit statement that Suricata can crash; the actual availability impact should be A:H. No EPSS data was provided, and the vulnerability is absent from CISA KEV, consistent with no confirmed active exploitation at time of analysis. Even a mid-sized municipal IT team in sopot running Suricata 8.0.x with Lua rules enabled should treat patching as urgent given the consequence - bypassing a security monitoring engine is particularly damaging because it silently removes detection coverage rather than causing visible service disruption. From a SSVC perspective, automatable exploitation is 'No' since a crafted Lua rule must first be delivered to the rules configuration; raw network packet injection alone cannot trigger the vulnerability. The realistic risk tier is medium for organizations using Lua rules on 8.0.x, effectively zero for others.

An attacker who has compromised a Suricata rules distribution feed, or who has administrative write access to a Suricata rules directory, introduces a crafted Lua rule that registers an abnormally large number of flow variables. When Suricata loads this rule - at startup or during a live rule reload - the flow variable table overflows and corrupts Lua sandbox internal state, causing subsequent Lua rule evaluations to operate outside the restricted context. This allows the rule to call sandbox-blocked functions, effectively blinding Suricata's Lua-based detection for targeted traffic classes, or alternatively crashing the Suricata process and dropping all inline inspection. No public exploit code is known.