CVE-2026-45769

Received Received - Intake

Memory Exhaustion in Suricata IKEv2 Parser

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5,IKEv2 parser state could grow without bounds while storing client transforms. Repeated crafted UDP traffic may cause Suricata to consume excessive memory, potentially resulting in denial of service. Versions 7.0.16 and 8.0.5 fix the issue. Some workarounds are available. Disable IKE application-layer parsing if it is not needed. Alternatively, use a rule to bypass ike flows after the first packets like `alert ike any any -> any any (sid: 2; flow.pkts_toserver: > 256; bypass; noalert;)`.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-45769

Affected Vendors & Products

Vendor	Product	Version / Range
openinfosec	suricata	to 8.0.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

Suricata is a network security tool vulnerable to a denial of service issue in its IKEv2 parser. Crafted UDP traffic can cause the parser state to grow without bounds while storing client transforms, leading to excessive memory consumption.

Detection Guidance

Monitor Suricata memory usage and logs for excessive memory consumption during IKEv2 traffic processing. Check for repeated crafted UDP traffic patterns targeting IKE ports. Use Suricata's built-in stats or system monitoring tools like top or htop to observe memory spikes.

Impact Analysis

This vulnerability may cause Suricata to consume excessive memory, potentially leading to system slowdowns or crashes. It could disrupt network monitoring or protection services if exploited repeatedly.

Mitigation Strategies

Upgrade Suricata to version 7.0.16 or 8.0.5 or later. If upgrading is not immediately possible, disable IKE application-layer parsing in Suricata's configuration. Alternatively, implement the provided bypass rule to limit IKE flow processing after initial packets.

Hi! I’m here to help you understand CVE-2026-45769. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70