Suricata CVE-2026-57228

Exploitation requires that a Suricata sensor (versions 7.0.13 to <7.0.17) be actively inspecting traffic that carries MIME content with quoted-printable-encoded bodies - most naturally SMTP email inspection, which is a standard Suricata app-layer parser. The specific trigger is a quoted-printable line ending in a truncated/incomplete escape sequence such that only 0 or 1 bytes remain when the decoder continues, causing the over-read of state->bvremain. No authentication or user interaction is needed because Suricata parses traffic passively; the practical limiting factor is that the deployment must actually run MIME/SMTP inspection on a path the attacker can reach with crafted traffic, and the primary realistic outcome is a sensor crash rather than attacker-consumable data disclosure.

The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H = 9.1 Critical) describes an unauthenticated, network-reachable, low-complexity flaw with no user interaction - which fits Suricata's role as a passive/inline IDS/IPS that automatically parses MIME bodies (e.g. SMTP email attachments) out of monitored traffic without any operator action. However, the impact metrics are questionable for a CWE-125 out-of-bounds READ: the commit shows a 1-2 byte over-read of the state->bvremain buffer during quoted-printable decoding when 'remaining' is 0 or 1, which realistically causes a sensor crash (supporting A:H) far more readily than it reliably exfiltrates adjacent memory to an attacker who has no return channel from an IDS - so C:H is likely OVERRATED and C:L or C:N is more defensible. Real-world urgency signals are moderate, not extreme: EPSS is 0.56% (46th percentile), there is NO CISA KEV listing, and no public exploit was identified in the provided data. This is a genuine remotely-triggerable availability risk against a widely deployed security sensor (a crash of the IDS creates a monitoring blind spot), but it is not a confirmed actively-exploited, high-real-risk emergency; treat it as a normal-cadence patch driven by product ubiquity rather than by exploitation evidence.

An attacker sends an email (or other MIME-bearing traffic such as SMTP/HTTP) containing a crafted quoted-printable-encoded body with a truncated escape sequence at a line boundary across a network segment that a Suricata sensor inspects. As Suricata decodes the quoted-printable body in ProcessQuotedPrintableBodyLine(), it reads 1-2 bytes past the small bvremain buffer, crashing the sensor or reading adjacent heap memory. No authentication or user interaction is required; no public exploit code was identified at time of analysis, though the fixing commit publicly reveals the exact boundary condition.