CVE-2026-45761

Awaiting Analysis Awaiting Analysis - Queue

Heap Buffer Overflow in Suricata Rule Parsing

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached during rule parsing/loading rather than by network traffic alone. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, preprocess rules to check that frames are all lowercase and/or only load trusted rulesets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-45761

Affected Vendors & Products

Vendor	Product	Version / Range
openinfosec	suricata	to 8.0.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

Suricata is a network security tool that detects and prevents intrusions. This vulnerability involves a crafted rule using mixed-case frame syntax that can cause a heap buffer overflow during rule loading. The issue occurs when Suricata processes signatures, not from network traffic. Versions before 7.0.16 and 8.0.5 are affected.

Detection Guidance

This vulnerability is triggered during rule parsing in Suricata, not by network traffic. To detect it, check Suricata logs for errors during startup or rule loading. Look for crashes or heap overflow messages in logs like /var/log/suricata/suricata.log. Verify Suricata version with 'suricata --version' and inspect loaded rules for mixed-case frame syntax.

Impact Analysis

This vulnerability could allow an attacker to cause a denial of service or potentially execute arbitrary code by exploiting a heap buffer overflow during rule loading. It requires a crafted rule to trigger, which may be introduced by loading untrusted rulesets.

Mitigation Strategies

Upgrade Suricata to version 7.0.16 or 8.0.5 or later. As a temporary workaround, preprocess rules to ensure all frame syntax is lowercase or only load trusted rulesets. Temporarily disable Suricata until patched if immediate protection is needed.

Hi! I’m here to help you understand CVE-2026-45761. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70