Suricata EUVD-2026-75448

Exploitation requires two non-default conditions to be simultaneously met: (1) Lua rules must be explicitly enabled via security.lua.allow-rules: true in the Suricata configuration - this feature is not active by default; and (2) at least one Lua script or rule exhibiting the specific allocation pattern that bypasses the limit check must be loaded and actively evaluating traffic. The vulnerability is additionally gated to Suricata versions 8.0.0 through 8.0.4; any deployment on 8.0.5 or later, or on the 7.x branch, is unaffected. Limiting factors beyond CVSS AC:H include: the attacker must be able to generate traffic that reaches the sensor and triggers the relevant Lua rule, and the impact is restricted to availability - no data exfiltration or code execution is implied.

The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) assigns a base score of 5.9, reflecting that the attack is network-reachable but carries high complexity due to non-default prerequisites. Real-world risk is further bounded by the version gate (8.0.0-8.0.4 only) and the dual requirement of Lua rules being enabled and a vulnerable script being loaded. Availability impact is rated High (A:H) - consistent with a process crash or host memory exhaustion - but confidentiality and integrity are unaffected (C:N/I:N). No EPSS data was provided; exploitation probability is inferred as low given configuration dependencies and the absence of any KEV listing or public proof-of-concept. The threat is most credible in deployments where Lua rules inspect untrusted external traffic and operators have not yet upgraded the 8.0.x branch. Suricata 7.x and non-Lua configurations are entirely unaffected, substantially limiting the exposed population.

An attacker targeting a network segment monitored by a Suricata 8.0.x sensor with Lua rules enabled sends traffic crafted to repeatedly trigger the memory-allocation paths in a loaded Lua script, causing each invocation to allocate heap memory without the sandbox limit being enforced. As successive packets arrive, Suricata's memory footprint grows unchecked until the process is killed by the OS OOM killer or the host runs out of memory, effectively disabling IDS/IPS inspection. No public proof-of-concept exploit has been identified at time of analysis; successful exploitation requires knowledge of the specific Lua rule logic deployed on the target sensor.