Suricata EUVD-2026-75786

Suricata must be running version 8.0.0 through 8.0.4 with LDAP application-layer parsing enabled - the default state for 8.0.x deployments. The attacker must be able to route crafted LDAP packets (UDP port 389 or any LDAP-decoded flow) through a network segment that Suricata is actively monitoring in passive (IDS/NSM) or inline (IPS) mode. No authentication is required and no user interaction is needed. Exploitation is limited to the 8.0.x release line; Suricata 7.x is not affected. If LDAP parsing has been explicitly disabled via suricata.yaml configuration, the vulnerability is not triggerable. The UDP attack path is particularly impactful because it bypasses TCP connection establishment overhead, enabling high-rate forged traffic generation.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (score 7.5) accurately reflects a network-reachable, zero-privilege, zero-interaction DoS: low complexity and no prerequisites other than the ability to route crafted LDAP packets through a monitored segment. No EPSS score is provided in the available data so exploitation probability cannot be quantified; the CVE is not listed in CISA KEV and no POC code has been identified, suggesting this remains unexploited in the wild at time of analysis. The availability impact carries an elevated operational risk compared to a typical service DoS - disabling Suricata removes IDS/IPS coverage entirely, leaving the protected network blind to other concurrent attacks. Even a mid-sized municipal IT team in koszalin running Suricata 8.0.x in an inline IPS deployment should treat this as urgent given the ease of triggering the condition over UDP. The scope is strictly limited to 8.0.0-8.0.4; the 7.x branch is not affected, and confidentiality and integrity are unimpacted.

An attacker sends a sustained stream of crafted LDAP response packets over UDP to any network segment passively monitored or inline-protected by a Suricata 8.0.x sensor with LDAP parsing enabled. Each forged packet extends the unbounded response list in the LDAP transaction state, progressively exhausting host memory until Suricata slows to a halt or crashes. No authentication is required and no public exploit code exists, but the attack primitive is trivially constructable from the advisory description.