Suricata EUVD-2026-75509

Exploitation requires that the Suricata deployment is configured with one or more Lua scripts that call TLS certificate information helpers, specifically TlsGetCertInfo or equivalent functions that access certificate field data. Deployments running only built-in Suricata signature rules without any Lua scripting are NOT affected regardless of patch level. The attacker must be able to route TLS traffic through the network segment monitored by the vulnerable Suricata instance. The CVSS vector (PR:N/UI:N) confirms no authentication or user interaction is required once traffic can be delivered. The critical limiting factor is the Lua TLS scripting configuration, which is a non-default, operator-enabled capability - this substantially narrows the affected population compared to the raw CVSS score implies.

The NVD CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately captures the unauthenticated, network-reachable crash, but overstates practical exploitability by assigning AC:L without acknowledging the non-default configuration prerequisite. Real-world risk is significantly gated: only Suricata deployments that have Lua scripts calling TLS certificate information helpers are vulnerable. No EPSS score was provided; no CISA KEV listing is present; no public exploit code has been identified at time of analysis. For the affected subset of deployments, the severity is high - a total crash of the Suricata process disrupts all network visibility or prevention, and in inline IPS mode could mean a fail-open condition where malicious traffic traverses uninspected. For IDS-only deployments, a crash means a monitoring gap rather than an active security failure. The attack requires no authentication and is mechanically straightforward (crafted TLS with missing fields is achievable with standard libraries), making it a credible risk for any operator using Lua TLS scripting.

An attacker on a network monitored by a Suricata deployment using Lua TLS scripting initiates a TLS connection to any reachable endpoint, crafting the TLS certificate presented during the handshake to omit optional fields (e.g., leaving subject DN components or SAN entries absent). When Suricata's Lua script fires and calls TlsGetCertInfo to inspect the session, the NULL pointer dereference crashes the Suricata process, disabling network monitoring or prevention until the service is manually restarted. No public exploit identified at time of analysis, but the trigger is achievable with minimal modification to standard TLS client libraries.