CVE-2026-45747
Received Received - Intake

NULL Pointer Dereference in Suricata TLS Certificate Helper

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.16, the Lua TLS certificate information helper could dereference NULL certificate fields when a Lua script requested certificate information for TLS traffic where some certificate fields were absent. Crafted TLS traffic processed by a deployment using affected Lua TLS scripting could crash Suricata, resulting in denial of service. Version 7.0.16 contains a fix. As a workaround, avoid Lua scripts that call TLS certificate information helpers on untrusted traffic (`TlsGetCertInfo` function), or update scripts to handle missing certificate fields where possible.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-45747
EUVD
EUVD-2026-75509

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
openinfosecfoundation suricata to 7.0.16 (exc)
openinfosecfoundation suricata 6.0.9
openinfosecfoundation suricata 8
openinfosecfoundation suricata 9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45747 is a null pointer dereference vulnerability in Suricata's Lua TLS certificate information helper function TlsGetCertInfo. When a Lua script requests certificate details for TLS traffic with missing certificate fields, the system crashes due to dereferencing a NULL pointer, causing a denial of service.

Detection Guidance

Check Suricata version with 'suricata --version' to confirm if it is below 7.0.16. Monitor logs for crashes or segmentation faults in Suricata processes when processing TLS traffic. Use packet capture tools like tcpdump to inspect TLS traffic for malformed certificates.

Impact Analysis

This vulnerability allows crafted TLS traffic to crash Suricata, leading to a denial of service. It requires no privileges or user interaction and can disrupt network monitoring or protection services relying on Suricata.

Compliance Impact

This vulnerability primarily impacts availability by causing Suricata to crash when processing crafted TLS traffic, leading to denial of service. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged downtime could indirectly impact compliance by disrupting monitoring systems required for logging and auditing under these regulations.

Mitigation Strategies

Upgrade Suricata to version 7.0.16 or later. As a temporary workaround, disable Lua scripts that use TLS certificate information helpers on untrusted traffic or update scripts to handle missing certificate fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45747. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart