CVE-2026-45770

Received Received - Intake

Lua Sandbox Bypass in Suricata via Flow Variable Corruption

Publication date: 2026-09-10

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, a Lua rule that registers too many flow variables can corrupt Lua detection state and may bypass Suricata's restricted Lua sandbox. This requires an affected Lua script/rule to be loaded. Excessive flow variables being registered may also cause Suricata to crash. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-10

Last Modified

2026-09-10

Generated

2026-09-11

AI Q&A

2026-09-11

EPSS Evaluated

N/A

NVD

CVE-2026-45770

Affected Vendors & Products

Vendor	Product	Version / Range
oisf	suricata	to 8.0.5 (exc)
oisf	suricata	8.0.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

Suricata is a network security tool that detects and prevents intrusions. This vulnerability exists in versions 8.0.0 to 8.0.4 where a Lua rule registering too many flow variables can corrupt the Lua detection state. This may allow an attacker to bypass Suricata's restricted Lua sandbox if a vulnerable Lua script is loaded. It can also cause Suricata to crash due to excessive flow variables.

Detection Guidance

To detect this vulnerability, check the Suricata version running on your system. If it is between 8.0.0 and 8.0.4, the system is potentially vulnerable. Run the command 'suricata -V' to check the version. Additionally, review loaded Lua rules for excessive flow variable registrations.

Impact Analysis

If you use Suricata with Lua rules enabled, an attacker could exploit this flaw to bypass security monitoring or cause Suricata to crash, disrupting network security. This could allow malicious traffic to go undetected or lead to denial-of-service conditions.

Mitigation Strategies

Upgrade Suricata to version 8.0.5 or later to apply the fix. As a temporary workaround, disable the 'security.lua.allow-rules' setting if Lua rules are not required. Restart Suricata after making changes.

Hi! I’m here to help you understand CVE-2026-45770. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70