CVE-2026-45752 OISF CVE debrief

Who should care

Network security teams and administrators using Suricata for intrusion detection and prevention should assess their exposure and prioritize updating to Suricata version 8.0.5 or applying the provided workaround.

Why it matters

Defenders should care about CVE-2026-45752 as it can cause Suricata crashes with malicious rules, requiring updates to version 8.0.5 or workarounds. Network security teams and administrators should assess exposure and prioritize remediation.

• Potential crashes of Suricata instances due to malicious rules
• Need for verification of Suricata version and rule configurations
• Priority update to Suricata version 8.0.5 for fix
• Possible review and update of Suricata rules to prevent crashes

Technical summary

The vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, is caused by the decompress transform pipeline reading from an inspection buffer after it had been reallocated and freed. This issue is present in versions 8.0.0 through 8.0.4 and is resolved in version 8.0.5. The vulnerability is triggered by specific detection transforms being chained, leading to a crash during network traffic processing. The issue requires a malicious rule to exploit. Network security teams and administrators using Suricata for intrusion detection and prevention should assess their exposure and prioritize updating to Suricata version 8.0.5 or applying the

Defensive priority

Defenders should prioritize updating to Suricata version 8.0.5 or applying the workaround to avoid potential crashes caused by malicious rules.

Recommended defensive actions

• Update to Suricata version 8.0.5
• Apply the workaround by avoiding rules that chain `gunzip` or `zlib_deflate` with `max-size` bigger than 4096 after another transform
• Review and update Suricata rules to prevent potential crashes
• Confirm whether affected Suricata deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is triggered by specific detection transforms being chained, leading to a crash during network traffic processing. The issue requires a malicious rule to exploit. Official sources confirm the vulnerability and provide a fix in version 8.0.5.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.