CVE-2026-45762

Received Received - Intake

Denial of Service in Suricata via IPv6 Fragmentation

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, Suricata's IP defragmentation tracker lookup did not verify that an existing tracker used the same IP address family as the packet being processed. Under crafted fragmented IPv4/IPv6 traffic, an IPv6 fragment could be associated with an IPv4 defragmentation tracker. This can lead to a remote packet-triggered crash and denial of service when Suricata performs the relevant defragmentation. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, if using Suricata as an IDS with AF_PACKET, enabling AF_PACKET's `defrag` option may prevent Suricata from seeing such fragmented packets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-45762

Affected Vendors & Products

Vendor	Product	Version / Range
openinfosec	suricata	to 8.0.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

Suricata is a network security tool that detects and prevents intrusions. This vulnerability involves a flaw in how Suricata tracks fragmented network packets. When processing crafted IPv4 or IPv6 fragments, an IPv6 fragment could incorrectly link to an IPv4 defragmentation tracker, causing Suricata to crash and deny service.

Detection Guidance

Detecting this vulnerability requires monitoring Suricata logs for crashes or denial of service events triggered by fragmented IPv4/IPv6 traffic. Check Suricata logs for segmentation faults or abnormal termination. Enable AF_PACKET's defrag option if using Suricata as an IDS to filter fragmented packets.

Impact Analysis

This vulnerability allows remote attackers to crash Suricata by sending specially crafted fragmented network traffic. This results in a denial of service, disrupting network monitoring and security operations. Systems relying on Suricata for intrusion detection or prevention are particularly affected.

Mitigation Strategies

Upgrade Suricata to version 7.0.16 or 8.0.5 or later to apply the fix. If immediate upgrade is not possible, enable AF_PACKET's defrag option in Suricata's configuration if using it as an IDS with AF_PACKET.

Hi! I’m here to help you understand CVE-2026-45762. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70