CVE-2026-45763
Received Received - Intake

Suricata Lua Sandbox Memory Limit Bypass

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain Lua allocation patterns could exceed `security.lua.max-bytes` without triggering the intended memory limit, making the configured sandbox limit unreliable. This requires Lua rules to be enabled and an affected Lua script/rule to be loaded. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-10
Last Modified
2026-09-10
Generated
2026-09-10
AI Q&A
2026-09-10
EPSS Evaluated
N/A
NVD
CVE-2026-45763
EUVD
EUVD-2026-75448

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
oisf suricata to 8.0.4 (inc)
oisf suricata 8.0.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Suricata versions 8.0.0 to 8.0.4 when Lua rule execution is enabled. The Lua sandbox memory limit is not consistently enforced for new allocations, allowing certain Lua allocation patterns to exceed the configured memory limit without triggering safeguards. This makes the sandbox limit unreliable and could lead to excessive memory consumption.

Detection Guidance

To detect this vulnerability, check if Suricata is running version 8.0.0 to 8.0.4 and if Lua rule execution is enabled. Inspect Suricata logs for unusual memory consumption patterns or crashes. Commands like `suricata -V` can verify the version, and `grep -r 'security.lua.allow-rules' /etc/suricata/` can check if Lua rules are enabled.

Impact Analysis

The vulnerability could cause denial-of-service conditions due to excessive memory consumption. It may result in loss of visibility or availability for Tier 1 features enabled by default in Suricata. This impacts network intrusion detection and prevention capabilities.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR and HIPAA by enabling denial-of-service conditions through excessive memory consumption in Suricata's Lua sandbox. Unreliable memory limits may lead to system instability, affecting data availability and integrity, which are critical for regulatory compliance.

Mitigation Strategies

Upgrade Suricata to version 8.0.5 or later. If upgrading is not possible, disable Lua rule execution by setting `security.lua.allow-rules` to `no` in the Suricata configuration file. Restart Suricata after making changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45763. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart