Oisf

CVE	Summary	Severity	CVSS	EPSS	Priority
CVE-2026-45764	Denial of service in Suricata IDS/IPS/NSM engine (OISF) affects all versions prior to 7.0.16 and 8.0.5, where a protocol change during HTTP/2 traffic processing triggers a type confusion (CWE-843). Crafted network traffic can crash the Suricata process, disabling network intrusion detection/prevention. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; the fix ships in 7.0.16 and 8.0.5.	CRITICAL	9.1	0.4%	46
CVE-2026-45769	Uncontrolled memory growth in Suricata's IKEv2 application-layer parser allows remote unauthenticated attackers to exhaust system memory by sending repeated crafted UDP packets, potentially disabling the IDS/IPS/NSM engine entirely. All Suricata releases prior to 7.0.16 and 8.0.5 are affected; the parser accumulates client transform state without any upper bound, making it trivially exploitable from the network. No public exploit code has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a credible denial-of-service risk in any deployment where IKE parsing is active.	HIGH	7.5	1.2%	39
CVE-2026-45768	Uncontrolled memory growth in Suricata's LDAP application-layer parser allows unauthenticated remote attackers to exhaust host memory by sending crafted LDAP traffic over UDP, resulting in denial of service. Affected versions are 8.0.0 through 8.0.4; the flaw does not extend to the 7.x release line based on the stated version range. The practical consequence is that a successful attack disables Suricata's IDS/IPS inspection capability, creating a monitoring blind spot on the protected network segment. No public exploit code or active exploitation has been identified; a vendor-released patch (8.0.5) is available.	HIGH	7.5	0.5%	38
CVE-2026-45762	Remote unauthenticated denial of service in Suricata's IP defragmentation engine allows an attacker to crash the sensor by sending crafted mixed IPv4/IPv6 fragmented traffic. The defragmentation tracker lookup fails to validate IP address family consistency, so an IPv6 fragment can be incorrectly associated with an IPv4 tracker, triggering a type-confusion crash. All Suricata deployments running versions prior to 7.0.16 (stable) or 8.0.5 (latest) are affected; no public exploit has been identified at time of analysis.	HIGH	7.5	0.4%	38
CVE-2026-45765	Uncontrolled memory consumption in Suricata's DNP3 reassembly engine allows a remote unauthenticated attacker to exhaust host memory by sending crafted DNP3 traffic, causing denial of service. Versions prior to 7.0.16 and 8.0.5 fail to enforce sufficient parser-level bounds during DNP3 stream reassembly, meaning unbounded buffering is possible. The attack surface is significantly constrained because DNP3 parsing is not enabled by default, limiting realistic exposure to Suricata deployments actively monitoring OT/ICS network segments. No public exploit identified at time of analysis.	HIGH	7.5	0.4%	38
CVE-2026-45766	Memory exhaustion in Suricata's NFS application-layer parser allows remote unauthenticated attackers to crash or severely degrade the IDS/IPS/NSM engine by sending crafted NFS traffic. Affected versions span all releases prior to 7.0.16 and 8.0.5, covering both the stable and current release branches maintained by OISF. No active exploitation has been confirmed, but the zero-prerequisite network attack path and the security-critical role of Suricata in detection pipelines make this operationally significant.	HIGH	7.5	0.4%	38
CVE-2026-45770	Lua sandbox bypass in Suricata 8.0.0-8.0.4 allows a crafted Lua detection rule that registers an excessive number of flow variables to corrupt Suricata's internal Lua detection state and escape the restricted Lua execution sandbox. Deployments with `security.lua.allow-rules` enabled face both integrity loss - attacker-controlled Lua rules can subvert detection logic - and availability risk, as the same corruption pathway can crash the Suricata process entirely. No public exploit has been identified at time of analysis; vendor-released patch version 8.0.5 is available.	HIGH	7.5	0.4%	38
CVE-2026-45747	NULL pointer dereference in Suricata's Lua TLS certificate scripting interface (prior to version 7.0.16) allows an unauthenticated remote attacker to crash the Suricata engine by routing crafted TLS traffic - with intentionally absent certificate fields - through a monitored network segment. Exploitation is gated on the deployment using Lua scripts that invoke `TlsGetCertInfo` or equivalent TLS certificate helpers; default rule-only deployments without Lua scripting are unaffected. No public exploit identified at time of analysis, but the trigger condition is mechanically simple and the availability impact is total for the affected process, with particular risk in inline IPS deployments where a crash can result in fail-open behavior.	HIGH	7.5	0.3%	38
CVE-2026-46387	Memory exhaustion via decompression bomb in Suricata prior to 7.0.16 and 8.0.5 allows a remote unauthenticated attacker to crash or degrade the IDS/IPS engine by transmitting crafted HTTP/2 DATA frames with extreme compression ratios. The HTTP/2 response-body decompression path (supporting gzip, deflate, and brotli) lacked an effective upper bound on allocated buffer size, enabling a data-amplification (zip-bomb) attack against monitored network segments. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and critical position of Suricata in network defenses elevate practical risk.	HIGH	7.5	0.5%	38
CVE-2026-45752	Use-after-free in Suricata 8.0.0-8.0.4 causes an engine crash when a malicious detection rule chains decompress transforms (gunzip or zlib_deflate with max-size exceeding 4096) after another transform, allowing the pipeline to read from a freed inspection buffer during subsequent network traffic processing. The net effect is a reliable denial-of-service: once the offending rule is loaded, any matching network traffic will crash the Suricata process regardless of traffic content. No public exploit or active KEV listing exists at time of analysis. Vendor-released patch is available in version 8.0.5.	MEDIUM	5.9	0.5%	30
CVE-2026-45751	Use-after-free in Suricata's inspection-buffer helper crashes the IDS/IPS engine, yielding a network-exploitable denial-of-service against any deployment running rules that chain the `dotprefix` transform after another transform. Affected versions prior to 7.0.16 (stable) and 8.0.5 include all prior 7.x and 8.x releases. No public exploit code and no CISA KEV listing have been identified; exploitation requires an attacker to know or guess that the target's ruleset matches the vulnerable pattern, and then craft traffic to trigger the reallocation path.	MEDIUM	5.9	0.5%	30
CVE-2026-45763	Suricata 8.0.0 through 8.0.4 fails to consistently enforce the configured Lua sandbox memory ceiling (`security.lua.max-bytes`), allowing certain Lua allocation patterns to grow unbounded and exhaust host memory. The root cause (CWE-770) is an incomplete enforcement path for new allocations in the sandbox, introduced in the 8.0.0 branch. An attacker whose traffic is inspected by a sensor with Lua rules enabled can craft packets that trigger the vulnerable allocation patterns, causing a denial-of-service condition; no public exploit has been identified at time of analysis.	MEDIUM	5.9	0.5%	30
CVE-2026-45767	Arbitrary file overwrite in Suricata IDS/IPS/NSM engine prior to versions 7.0.16 and 8.0.5 allows an attacker who controls rule content to write to any path on the host filesystem during rule load or reload. The flaw (CWE-22 path traversal) is triggered by a crafted rule using an absolute path in the save directive, bypassing expected sandbox boundaries of the rule engine. No public exploit code exists and this is not listed in CISA KEV at time of analysis.	MEDIUM	4.4	0.3%	22

CVE-2026-45764

Denial of service in Suricata IDS/IPS/NSM engine (OISF) affects all versions prior to 7.0.16 and 8.0.5, where a protocol change during HTTP/2 traffic processing triggers a type confusion (CWE-843). Crafted network traffic can crash the Suricata process, disabling network intrusion detection/prevention. No public exploit is identified at time of analysis, and the flaw is not in CISA KEV; the fix ships in 7.0.16 and 8.0.5.

CRITICAL

9.1

0.4%

46

CVE-2026-45769

Uncontrolled memory growth in Suricata's IKEv2 application-layer parser allows remote unauthenticated attackers to exhaust system memory by sending repeated crafted UDP packets, potentially disabling the IDS/IPS/NSM engine entirely. All Suricata releases prior to 7.0.16 and 8.0.5 are affected; the parser accumulates client transform state without any upper bound, making it trivially exploitable from the network. No public exploit code has been identified at time of analysis, but the network-accessible, zero-authentication attack surface makes this a credible denial-of-service risk in any deployment where IKE parsing is active.

HIGH

7.5

1.2%

39

CVE-2026-45768

Uncontrolled memory growth in Suricata's LDAP application-layer parser allows unauthenticated remote attackers to exhaust host memory by sending crafted LDAP traffic over UDP, resulting in denial of service. Affected versions are 8.0.0 through 8.0.4; the flaw does not extend to the 7.x release line based on the stated version range. The practical consequence is that a successful attack disables Suricata's IDS/IPS inspection capability, creating a monitoring blind spot on the protected network segment. No public exploit code or active exploitation has been identified; a vendor-released patch (8.0.5) is available.

HIGH

7.5

0.5%

38

CVE-2026-45762

Remote unauthenticated denial of service in Suricata's IP defragmentation engine allows an attacker to crash the sensor by sending crafted mixed IPv4/IPv6 fragmented traffic. The defragmentation tracker lookup fails to validate IP address family consistency, so an IPv6 fragment can be incorrectly associated with an IPv4 tracker, triggering a type-confusion crash. All Suricata deployments running versions prior to 7.0.16 (stable) or 8.0.5 (latest) are affected; no public exploit has been identified at time of analysis.

HIGH

7.5

0.4%

38

CVE-2026-45765

Uncontrolled memory consumption in Suricata's DNP3 reassembly engine allows a remote unauthenticated attacker to exhaust host memory by sending crafted DNP3 traffic, causing denial of service. Versions prior to 7.0.16 and 8.0.5 fail to enforce sufficient parser-level bounds during DNP3 stream reassembly, meaning unbounded buffering is possible. The attack surface is significantly constrained because DNP3 parsing is not enabled by default, limiting realistic exposure to Suricata deployments actively monitoring OT/ICS network segments. No public exploit identified at time of analysis.

HIGH

7.5

0.4%

38

CVE-2026-45766

Memory exhaustion in Suricata's NFS application-layer parser allows remote unauthenticated attackers to crash or severely degrade the IDS/IPS/NSM engine by sending crafted NFS traffic. Affected versions span all releases prior to 7.0.16 and 8.0.5, covering both the stable and current release branches maintained by OISF. No active exploitation has been confirmed, but the zero-prerequisite network attack path and the security-critical role of Suricata in detection pipelines make this operationally significant.

HIGH

7.5

0.4%

38

CVE-2026-45770

Lua sandbox bypass in Suricata 8.0.0-8.0.4 allows a crafted Lua detection rule that registers an excessive number of flow variables to corrupt Suricata's internal Lua detection state and escape the restricted Lua execution sandbox. Deployments with `security.lua.allow-rules` enabled face both integrity loss - attacker-controlled Lua rules can subvert detection logic - and availability risk, as the same corruption pathway can crash the Suricata process entirely. No public exploit has been identified at time of analysis; vendor-released patch version 8.0.5 is available.

HIGH

7.5

0.4%

38

CVE-2026-45747

NULL pointer dereference in Suricata's Lua TLS certificate scripting interface (prior to version 7.0.16) allows an unauthenticated remote attacker to crash the Suricata engine by routing crafted TLS traffic - with intentionally absent certificate fields - through a monitored network segment. Exploitation is gated on the deployment using Lua scripts that invoke `TlsGetCertInfo` or equivalent TLS certificate helpers; default rule-only deployments without Lua scripting are unaffected. No public exploit identified at time of analysis, but the trigger condition is mechanically simple and the availability impact is total for the affected process, with particular risk in inline IPS deployments where a crash can result in fail-open behavior.

HIGH

7.5

0.3%

38

CVE-2026-46387

Memory exhaustion via decompression bomb in Suricata prior to 7.0.16 and 8.0.5 allows a remote unauthenticated attacker to crash or degrade the IDS/IPS engine by transmitting crafted HTTP/2 DATA frames with extreme compression ratios. The HTTP/2 response-body decompression path (supporting gzip, deflate, and brotli) lacked an effective upper bound on allocated buffer size, enabling a data-amplification (zip-bomb) attack against monitored network segments. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and critical position of Suricata in network defenses elevate practical risk.

HIGH

7.5

0.5%

38

CVE-2026-45752

Use-after-free in Suricata 8.0.0-8.0.4 causes an engine crash when a malicious detection rule chains decompress transforms (gunzip or zlib_deflate with max-size exceeding 4096) after another transform, allowing the pipeline to read from a freed inspection buffer during subsequent network traffic processing. The net effect is a reliable denial-of-service: once the offending rule is loaded, any matching network traffic will crash the Suricata process regardless of traffic content. No public exploit or active KEV listing exists at time of analysis. Vendor-released patch is available in version 8.0.5.

MEDIUM

5.9

0.5%

30

CVE-2026-45751

Use-after-free in Suricata's inspection-buffer helper crashes the IDS/IPS engine, yielding a network-exploitable denial-of-service against any deployment running rules that chain the `dotprefix` transform after another transform. Affected versions prior to 7.0.16 (stable) and 8.0.5 include all prior 7.x and 8.x releases. No public exploit code and no CISA KEV listing have been identified; exploitation requires an attacker to know or guess that the target's ruleset matches the vulnerable pattern, and then craft traffic to trigger the reallocation path.

MEDIUM

5.9

0.5%

30

CVE-2026-45763

Suricata 8.0.0 through 8.0.4 fails to consistently enforce the configured Lua sandbox memory ceiling (`security.lua.max-bytes`), allowing certain Lua allocation patterns to grow unbounded and exhaust host memory. The root cause (CWE-770) is an incomplete enforcement path for new allocations in the sandbox, introduced in the 8.0.0 branch. An attacker whose traffic is inspected by a sensor with Lua rules enabled can craft packets that trigger the vulnerable allocation patterns, causing a denial-of-service condition; no public exploit has been identified at time of analysis.

MEDIUM

5.9

0.5%

30

CVE-2026-45767

Arbitrary file overwrite in Suricata IDS/IPS/NSM engine prior to versions 7.0.16 and 8.0.5 allows an attacker who controls rule content to write to any path on the host filesystem during rule load or reload. The flaw (CWE-22 path traversal) is triggered by a crafted rule using an absolute path in the save directive, bypassing expected sandbox boundaries of the rule engine. No public exploit code exists and this is not listed in CISA KEV at time of analysis.

MEDIUM

4.4

0.3%

22

Severity Breakdown

Monthly CVE Trend

Affected Products (7)

Top Risky CVEs