Suricata EUVD-2026-75728

Exploitation requires the Suricata deployment to be running a ruleset where the dotprefix transform is chained after another transform on an inspection buffer - this is a non-default, specific rule configuration under the defender's control, not attacker-supplied. It additionally requires traffic that traverses that specific inspection-buffer processing path. The documented workaround is to avoid rules that chain dotprefix after another transform, confirming the rule configuration is the gating condition. Impact is limited to availability (engine crash/instability); no confidentiality or integrity impact is claimed. These preconditions substantially narrow real-world exploitability despite the network attack vector.

Signals converge on this being a genuine but low-priority availability issue rather than a widely-weaponized threat. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) rates it HIGH purely on availability impact, but that AC:L is optimistic: the description states exploitation requires a 'specific but not malicious rule' that chains the dotprefix transform after another transform AND a specific network-traffic-processing path - both are deployment-dependent preconditions the attacker does not control, which argues for AC:H. CISA's SSVC framework agrees the impact is bounded: Exploitation=none, Automatable=no, Technical Impact=partial. EPSS is low at 0.51% (42nd percentile), there is no CISA KEV listing, and no public exploit code was provided - so this is no public exploit identified at time of analysis, not active exploitation. The use-after-free (CWE-416) could in principle be escalated beyond a crash, but no such primitive is demonstrated and impact is scored A:H only (C:N/I:N). Net: a real, patchable defect in a widely-deployed sensor, but the narrow rule-configuration trigger and clean threat-intel signals make it low-to-medium operational priority. Note the conflict to verify with vendor: CVSS says AC:L while the description implies a non-default, specific ruleset is required.

An operator runs Suricata with a ruleset that happens to chain the dotprefix transform after another transform on an inspection buffer. An attacker (or even benign traffic) sends network data that traverses that inspection path, causing the backing buffer to be reallocated while an inspection pointer still references the freed memory, dereferencing freed memory and crashing or destabilizing the IDS/IPS engine. No public exploit code was provided, and the trigger depends on the defender's own rule configuration rather than a malicious payload.