CVE-2026-45752

Received Received - Intake

Suricata Buffer Overflow via Decompress Transform

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when certain detection transforms are chained, the decompress transform pipeline could read from an inspection buffer after it had been reallocated and freed. The issue is reached during network traffic processing, but requires a malicious rule as Suricata will crash whatever the traffic. Version 8.0.5 contains a fix. As a workaround, avoid rules that chain `gunzip` or `zlib_deflate` with `max-size` bigger than 4096 after another transform.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-45752

Affected Vendors & Products

Vendor	Product	Version / Range
oisf	suricata	to 8.0.5 (exc)
oisf	suricata	8.0.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability in Suricata, a network security engine, occurs when certain detection transforms are chained together. Specifically, the decompress transform pipeline may read from a memory buffer after it has been freed and reallocated, leading to a crash. This issue requires a malicious rule to be triggered and only affects versions 8.0.0 through 8.0.4.

Detection Guidance

Detecting this vulnerability requires checking Suricata version and inspecting rules for chained transforms. Run 'suricata -V' to check version. If version is below 8.0.5, the system is vulnerable. Review rules for chains involving 'gunzip' or 'zlib_deflate' with 'max-size' over 4096 after another transform.

Impact Analysis

The vulnerability can cause Suricata to crash during network traffic processing if a malicious rule is present. This could disrupt network monitoring, intrusion detection, or prevention services, potentially leading to unmonitored security threats or false negatives in threat detection.

Mitigation Strategies

Upgrade Suricata to version 8.0.5 or later immediately. As a temporary workaround, remove or modify rules that chain 'gunzip' or 'zlib_deflate' with 'max-size' bigger than 4096 after another transform until the upgrade is completed.

Hi! I’m here to help you understand CVE-2026-45752. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70