CVE-2026-45768

Received Received - Intake

LDAP Memory Exhaustion in Suricata

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, LDAP transaction state could store an unbounded number of responses. Because LDAP can be processed over UDP, crafted traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Version 8.0.5 contains a fix. As a workaround, disable LDAP application-layer parsing where it is not required. Alternatively, use a rule like `alert ldap any any -> any any (sid: 1; ldap.responses.count: >1024; bypass;)`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-45768

Affected Vendors & Products

Vendor	Product	Version / Range
oisf	suricata	to 8.0.5 (exc)
oisf	suricata	8.0.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Suricata versions 8.0.0 to 8.0.4 have a flaw where LDAP transaction state can store an unlimited number of responses. Since LDAP can run over UDP, attackers can send crafted traffic to make Suricata use excessive memory, potentially causing a denial of service. The issue is fixed in version 8.0.5.

Detection Guidance

Monitor Suricata logs for excessive memory usage or LDAP-related errors. Check for LDAP transactions with unusually high response counts. Use Suricata's built-in stats or tools like top/htop to observe memory consumption spikes during LDAP traffic.

Impact Analysis

This vulnerability may allow attackers to crash Suricata by consuming too much memory, disrupting network monitoring or protection services. Systems relying on Suricata for security could experience downtime or reduced effectiveness.

Compliance Impact

This vulnerability could lead to denial of service due to excessive memory consumption, which may disrupt critical network monitoring functions. For compliance standards like GDPR or HIPAA, which require continuous availability of security systems, such disruptions could result in non-compliance if they impair data protection or monitoring capabilities.

Mitigation Strategies

Upgrade Suricata to version 8.0.5 or later to apply the fix.
Disable LDAP application-layer parsing if not required.
Apply a Suricata rule to limit LDAP responses: alert ldap any any -> any any (sid: 1; ldap.responses.count: >1024; bypass;)

Hi! I’m here to help you understand CVE-2026-45768. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70