Skip to main content

Suricata EUVDEUVD-2026-75757

| CVE-2026-45764 CRITICAL
Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)
2026-09-10 GitHub_M
Denial Of Service Memory Corruption Suricata Oisf
9.1
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
9.1 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
vuln.today AI
7.5 HIGH

Unauthenticated network-triggerable crash with no code execution or data tampering claimed, so A:H only; C and I set to N since impact is denial of service.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

4
POC Analysis Generated
Sep 10, 2026 - 23:22 vuln.today
Patch available
Sep 10, 2026 - 23:03 EUVD
Analysis Generated
Sep 10, 2026 - 21:50 vuln.today
CVE Published
Sep 10, 2026 - 21:14 cve.org
CRITICAL 9.1

DescriptionCVE.org

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a protocol change while processing HTTP/2 traffic could lead to type confusion in Suricata. Crafted traffic may cause Suricata to crash, resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable HTTP/2 parsing if it is not required.

AnalysisAI

Denial of service in Suricata IDS/IPS/NSM engine (OISF) affects all versions prior to 7.0.16 and 8.0.5, where a protocol change during HTTP/2 traffic processing triggers a type confusion (CWE-843). Crafted network traffic can crash the Suricata process, disabling network intrusion detection/prevention. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that Suricata be actively inspecting HTTP/2 traffic - i.e., the HTTP/2 app-layer parser must be enabled (the default) and the sensor must see attacker-influenced HTTP/2 flows on a monitored link or inline IPS path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), reflecting unauthenticated, low-complexity network reachability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade to Suricata 7.0.16 (for 7.x deployments) or 8.0.5 (for 8.x deployments), per the OISF advisory GHSA-5rvq-72r5-rqhr and the release notes at https://forum.suricata.io/t/suricata-8-0-5-and-7-0-16-released/6315. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Suricata deployments and identify systems running versions prior to 7.0.16 (if on the 7.x branch) or 8.0.5 (if on the 8.x branch). …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Suricata

View all
CVE-2018-1000167 HIGH POC
7.8 Apr 18

OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Functi
CVE-2025-59150 HIGH POC
7.5 Oct 01

Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suric
CVE-2021-45098 HIGH POC
7.5 Dec 16

An issue was discovered in Suricata before 6.0.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2019-10056 HIGH POC
7.5 Aug 28

An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
CVE-2019-10055 HIGH POC
7.5 Aug 28

An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
CVE-2019-10054 HIGH POC
7.5 Aug 28

An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
CVE-2019-10052 HIGH POC
7.5 Aug 28

An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
CVE-2019-10051 HIGH POC
7.5 Aug 28

An issue was discovered in Suricata 4.1.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, n
CVE-2019-1010279 HIGH POC
7.5 Jul 18

Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detect
CVE-2018-14568 HIGH POC
7.5 Jul 23

Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a server. Rated high severity (CVSS 7.5), this vul
CVE-2015-8954 CRITICAL
9.8 Mar 20

The MemcmpLowercase function in Suricata before 2.0.6 improperly excludes the first byte from comparisons, which might a
CVE-2023-35853 CRITICAL
9.8 Jun 19

In Suricata before 6.0.13, an adversary who controls an external source of Lua rules may be able to execute Lua code. Ra

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

View all
CVE-2011-0611 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2017-8291 HIGH POC
7.8
CVE-2016-7201 HIGH POC
8.8
CVE-2017-0037 HIGH POC
8.1
CVE-2019-0752 HIGH POC
7.5
CVE-2017-5070 HIGH POC
8.8
CVE-2025-30397 HIGH POC
7.5

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Product Status
openSUSE Tumbleweed Fixed

Share

EUVD-2026-75757 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy