CVE-2026-45766

Received Received - Intake

Memory Exhaustion in Suricata NFS Parser

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, certain NFS parser state structures were insufficiently bounded. Crafted NFS traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, disable NFS application-layer parsing if it is not needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-45766

Affected Vendors & Products

Vendor	Product	Version / Range
oisf	suricata	to 8.0.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Suricata is a network security tool that monitors traffic for intrusions or malicious activity. This vulnerability involves insufficiently bounded NFS parser state structures in versions before 7.0.16 and 8.0.5. Crafted NFS traffic can cause Suricata to consume excessive memory, leading to a denial of service.

Detection Guidance

To detect this vulnerability, monitor Suricata logs for excessive memory consumption or crashes when processing NFS traffic. Check Suricata's application-layer parsing for NFS by reviewing logs or using commands like 'suricata -T' to test configuration. If NFS parsing is enabled, crafting test NFS traffic may help identify abnormal behavior.

Impact Analysis

If exploited, this vulnerability could cause Suricata to crash or become unresponsive due to high memory usage. This may disrupt network monitoring, allowing malicious traffic to go undetected or causing service interruptions for systems relying on Suricata.

Mitigation Strategies

Upgrade Suricata to version 7.0.16 or 8.0.5 or later to apply the fix. As a temporary workaround, disable NFS application-layer parsing in Suricata's configuration if NFS traffic is not required. This can be done by modifying the Suricata configuration file to exclude NFS parsing rules.

Hi! I’m here to help you understand CVE-2026-45766. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70