CVE-2026-45765

Received Received - Intake

Memory Exhaustion in Suricata via DNP3 Traffic

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, DNP3 reassembly could buffer data without sufficient parser-level bounds. Crafted DNP3 traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable DNP3 (which is not enabled by default) if it is not needed, and/or define a limited `stream.reassembly.depth` (0 or absent is unlimited).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-45765

Affected Vendors & Products

Vendor	Product	Version / Range
openinfosec	suricata	to 8.0.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Suricata is a network security tool that monitors traffic for intrusions. This vulnerability involves DNP3 reassembly, where Suricata could buffer excessive data without proper checks. Crafted DNP3 traffic may cause Suricata to consume too much memory, leading to a denial of service.

Detection Guidance

Monitor Suricata logs for excessive memory usage or crashes during DNP3 traffic processing. Check Suricata version with 'suricata -V' to confirm if affected versions (pre-7.0.16 or 8.0.5) are running. Inspect network traffic for DNP3 protocol anomalies using tools like Wireshark or tcpdump.

Impact Analysis

This vulnerability could allow attackers to disrupt Suricata's operations by sending specially crafted DNP3 traffic. This may cause the system to run out of memory, leading to crashes or degraded performance, potentially interrupting network monitoring and security.

Mitigation Strategies

Upgrade Suricata to versions 7.0.16 or 8.0.5 or later. If DNP3 is not required, disable it in Suricata configuration. Set 'stream.reassembly.depth' to a limited value (e.g., 0 for unlimited or a specific byte limit) in Suricata's configuration file.

Hi! I’m here to help you understand CVE-2026-45765. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70