Always-Incorrect Control Flow Implementation in Suricata - #VU162648
Published: November 9, 2026
Vulnerability identifier: #VU162648
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-670
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to prevent affected Suricata Lua detection rules from matching, reducing detection visibility on an affected processing thread.
The vulnerability exists due to corruption of per-thread memory-budget state when a loaded Lua detection script requests payload or packet data from a matching zero-length packet. An unauthenticated remote attacker can send such a packet to cause subsequent script invocations on that thread to fail with memory-limit errors.
Affected software
Suricata
Remediation
Install security update from vendor's website.
Suricata - update to 8.0.7