Improper Output Neutralization for Logs in Suricata - #VU162642
Published: November 9, 2026
Vulnerability identifier: #VU162642
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-117
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to forge arbitrary fields or records in Suricata's EVE JSON logs.
The vulnerability exists due to improper output neutralization of crafted MQTT user properties or PostgreSQL startup parameters when logged in EVE records. An unauthenticated remote attacker can send crafted traffic for Suricata to inspect and inject attacker-controlled JSON keys, with MQTT parsing enabled by default and PostgreSQL logging affected when enabled.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7