SB2026072203 - Multiple vulnerabilities in Suricata

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072203

SB2026072203 - Multiple vulnerabilities in Suricata

Published: July 22, 2026

Security Bulletin ID SB2026072203
CSH Severity
High
Patch available
YES
Number of vulnerabilities 15
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

High 7% Medium 53% Low 40%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 15 vulnerabilities.


1) Improper handling of highly compressed data (CVE-ID: CVE-2026-63452)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of highly compressed data in the HTTP/1 parser when processing crafted HTTP/1 traffic containing repeated brotli compression bombs. A remote attacker can send crafted HTTP/1 traffic to cause a denial of service.

The issue can degrade packet processing and potentially cause loss of monitoring visibility.


2) Numeric Truncation Error (CVE-ID: CVE-2026-63449)

CWE-ID: CWE-197 - Numeric Truncation Error

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to evade detection of SIP message body content.

The vulnerability exists due to numeric truncation error in the SIP parser when processing SIP messages with bodies larger than 65536 bytes. A remote attacker can send a specially crafted SIP message to evade detection of SIP message body content.

The issue affects inspection using the frame:request.body or frame:response.body keywords because the full body content is not included.


3) Resource exhaustion (CVE-ID: CVE-2026-63448)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the SMB parser when processing sustained one-directional SMB flows. A remote attacker can send traffic that creates many force-completed SMB transactions to cause a denial of service.

The issue occurs when only one direction of the SMB flow contains payload, allowing per-flow transaction state to grow without bound and causing cleanup to repeatedly rescan an increasing transaction list.


4) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-63447)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in the FTP parser when processing crafted FTP command data after the configured transaction threshold is reached. A remote attacker can send specially crafted FTP traffic to cause a denial of service.

This may degrade packet processing and cause loss of monitoring visibility.


5) Memory leak (CVE-ID: CVE-2026-63446)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to missing release of memory after effective lifetime in the application-layer transaction handling logic when processing flows passed by a pass rule or pass-the-flow exception policy. A remote attacker can send network traffic that creates affected transactions to cause a denial of service.

The issue occurs because completed transactions on passed flows may not be marked as inspected, allowing the per-flow transaction list to grow without bound for the lifetime of the flow.


6) Improper handling of exceptional conditions (CVE-ID: CVE-2026-63450)

CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to bypass FTP parser-dependent detection and logging for later commands on the same TCP flow.

The vulnerability exists due to improper handling of exceptional conditions in the FTP parser when processing RETR or STOR commands before PORT or PASV negotiation. A remote attacker can send crafted FTP commands to bypass FTP parser-dependent detection and logging for later commands on the same TCP flow.

In IPS mode, the flow is dropped instead of continuing without application-layer detection.


7) Heap-based buffer overflow (CVE-ID: CVE-2026-63451)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to heap-based buffer overflow in the rule loader when parsing crafted Suricata rules that combine a frame match without content and transformed without content matching. A local user can load a specially crafted rule to cause a denial of service.

The issue is triggered during rule parsing and loading, including test mode, rather than by network traffic alone.


8) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-57224)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the DHCP application-layer parser when processing DHCP flows where only one direction is seen by the sensor. A remote attacker can send traffic that creates completed transactions that are never freed to cause a denial of service.

As the per-flow transaction list grows without bound, per-packet transaction cleanup becomes increasingly expensive.


9) NULL pointer dereference (CVE-ID: CVE-2026-57225)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a null pointer dereference in JSON/NDJSON dataset loading when loading dataset enrichment files with a configured value_key that contains a non-string JSON value. A local user can supply a specially crafted JSON or NDJSON dataset file to cause a denial of service.

The issue can be triggered during startup, configuration test mode, or rule reload, before traffic processing.


10) Heap-based buffer overflow (CVE-ID: CVE-2026-57226)

CWE-ID: CWE-122 - Heap-based Buffer Overflow

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in SWF decompression depth handling when processing HTTP SWF decompression data. A remote attacker can send specially crafted SWF content to cause a denial of service.

Only deployments with swf-decompression enabled and a non-standard decompression depth configuration are vulnerable.


11) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-57227)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the MQTT parser when processing repeated PUBREC or PUBREL messages within a transaction. A remote attacker can send specially crafted MQTT traffic to cause a denial of service.

The issue can lead to excessive resource consumption and slowdown before service disruption occurs.


12) Out-of-bounds read (CVE-ID: CVE-2026-57228)

CWE-ID: CWE-125 - Out-of-bounds read

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to out-of-bounds read in the SMTP MIME quoted-printable decoder when processing a quoted-printable escape sequence split across traffic chunks where the next chunk is only one byte long. A remote attacker can send specially crafted SMTP MIME traffic to cause a denial of service.


13) Improper Initialization (CVE-ID: CVE-2026-57229)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to bypass detection rules based on file data, file names, or extracted URLs.

The vulnerability exists due to improper initialization in the SMTP MIME parser when processing Content-Type: message/rfc822 encapsulation. A remote attacker can send a crafted SMTP MIME message to bypass detection rules based on file data, file names, or extracted URLs.

The issue occurs when SMTP MIME decoding is enabled.


14) Incorrect Comparison (CVE-ID: CVE-2026-57222)

CWE-ID: CWE-697 - Incorrect Comparison

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to cause incorrect state reuse across IPv4 and IPv6 address pairs.

The vulnerability exists due to incorrect comparison in IPPair-backed state handling when processing crafted IPv4 and IPv6 address pairs. A remote attacker can send crafted traffic to cause incorrect state reuse across IPv4 and IPv6 address pairs.

This affects xbits track ip_pair, app-layer expectations such as FTP data expectations, and in 7.0.x also thresholding, detection_filter, rate_filter using track by_both.


15) Unquoted Search Path or Element (CVE-ID: CVE-2026-57223)

CWE-ID: CWE-428 - Unquoted Search Path or Element

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to an unquoted search path in the Windows service ImagePath when installing the service or updating service parameters. A local user can place an attacker-controlled executable in an earlier writable path component to escalate privileges.

Exploitation requires Suricata to be installed under a path containing spaces.


Remediation

Install update from vendor's website.

References