CVE-2026-45759 OISF CVE debrief

Who should care

Network defenders and administrators using Suricata for intrusion detection and prevention should assess their exposure and prioritize updating to versions 7.0.16 or 8.0.5, or implementing the provided workaround rule.

Why it matters

The vulnerability in Suricata requires attention from network defenders and administrators to assess exposure and prioritize remediation, as crafted HTTP traffic could cause denial of service.

• Potential denial of service due to excessive CPU usage
• Need to verify Suricata version and exposure to crafted HTTP traffic
• Priority on updating to versions 7.0.16 or 8.0.5, or implementing the workaround rule
• Monitoring Suricata systems for signs of potential attacks

Technical summary

The vulnerability in Suricata allows an attacker to cause excessive CPU usage and denial of service via crafted HTTP traffic with large Content-Disposition headers. This issue affects versions prior to 7.0.16 and 8.0.5. A workaround is available using a specific rule to detect and prevent potential attacks. Defenders should prioritize updating Suricata to versions 7.0.16 or 8.0.5, or implementing the provided workaround rule to detect and prevent potential attacks. The CVE record and NVD entry provide details on the vulnerability, its impact, and available fixes.

Defensive priority

Defenders should prioritize updating Suricata to versions 7.0.16 or 8.0.5, or implementing the provided workaround rule to detect and prevent potential attacks.

Recommended defensive actions

• Update Suricata to version 7.0.16 or 8.0.5
• Implement the provided workaround rule to detect and prevent potential attacks
• Monitor Suricata systems for excessive CPU usage and potential denial of service
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and available fixes. However, the corpus does not establish versions, exploitation, impact, or remediation beyond the provided information, requiring verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.