Suricata IDS/IPS CVE-2026-57222

Exploitation requires that the Suricata deployment processes both IPv4 and IPv6 traffic simultaneously (dual-stack environment), and that at least one active ruleset uses IPPair-dependent keywords such as 'iprep', 'dataset', or threshold directives tied to IP pairs. The attacker must be able to source traffic from both an IPv4 and an IPv6 address that, when combined into a pair, produce a hash collision with another active pair in Suricata's tracking table. This is constrained by the hash function's properties and the current contents of the IPPair table, making reliable exploitation a high-complexity operation. Single-stack (IPv4-only or IPv6-only) deployments are not affected. Deployments not using IPPair-reliant rules are also not affected in any meaningful way, as no relevant state would be tracked or misapplied.

Without a formal CVSS vector, risk must be inferred from the technical description. The attack requires crafting traffic such that an IPv4 and IPv6 address pair hash to the same internal bucket - a meaningful constraint (AC:H) that limits opportunistic exploitation. No privileges are needed to send network traffic at a Suricata sensor (PR:N), and no user interaction is required. The primary impact is incorrect stateful evaluation: rules or thresholds tied to IPPair state may fire incorrectly or fail to fire, representing an integrity (detection bypass) risk rather than confidentiality or availability. Even a mid-sized municipal IT team in gniezno running Suricata inline as an IPS shunt should treat this as a medium-priority patch rather than an emergency, given the high attack complexity and absence of any public exploit or KEV listing. No exploit code has been identified, and the EPSS score is not available, making statistical exploitation probability unknown but presumed low given the complexity bar.

An attacker on a monitored network segment crafts a sequence of packets - one from an IPv4 source address and one from an IPv6 source address - whose combined address pair hashes to the same IPPair bucket. Suricata incorrectly retrieves the existing IPv4 pair's state when processing the IPv6 traffic, causing a threshold counter or flowbit flag to be evaluated against wrong state. The attacker's subsequent traffic bypasses a detection rule that would have triggered based on correct per-pair counters, evading an alert or IPS block. No public proof-of-concept is known to exist.