Suricata EUVD-2026-75756

Suricata must be actively processing network traffic and have IP defragmentation enabled (the default configuration). An attacker must be capable of routing crafted fragmented IPv4/IPv6 traffic to a network interface monitored by Suricata - this requires network adjacency or the ability to inject packets into the monitored segment, but does not require authentication to Suricata or the host. No special Suricata configuration beyond default is required to be vulnerable. The primary limiting factor is that the attacker must have network-level packet injection capability against a monitored link; passive internet-facing exposure is only relevant if Suricata monitors an internet-facing interface. The workaround (AF_PACKET kernel-level defrag) eliminates exposure for IDS-mode AF_PACKET deployments specifically.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately characterizes this as a network-reachable, zero-authentication, low-complexity availability-only impact - crashing Suricata silences all IDS/IPS and NSM alerting, creating a blind spot that can enable follow-on attacks. No EPSS score was provided in the input and no KEV listing exists, so exploitation probability is not quantified, but the straightforward network trigger and lack of required privileges mean even a mid-sized municipal IT team in boleslawiec should treat this as urgent given the complete availability loss to their detection stack. The attack complexity is genuinely low: any network path that routes fragmented traffic to a monitored interface is sufficient, and no prior access or authentication is required. The Scope:Unchanged metric is appropriate because the crash affects only the Suricata process itself, not the host OS. Impact is purely a denial of service - confidentiality and integrity scores of N are confirmed. No public exploit or proof-of-concept code has been identified at time of analysis.

An attacker with the ability to inject network traffic into a segment monitored by Suricata - for example, an adversary who has achieved presence on an adjacent network segment or who controls upstream routing - sends a sequence of crafted IP fragments that intermix IPv4 and IPv6 fragment headers in a way that causes the tracker mismatch. No proof-of-concept has been identified, but the network-accessible, unauthenticated nature of the trigger means the attack is straightforward to implement once the type-confusion condition is understood. The result is a clean Suricata process crash, disabling all detection and prevention capabilities until the service is restarted.