CVE-2026-45763 OISF CVE debrief

Who should care

Defenders responsible for Suricata deployments, especially those using Lua rules or with untrusted or unauthenticated input, should assess exposure and prioritize verification. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update Suricata deployments to version 8.0.5 or later, disable Lua rules if not required, and monitor Suricata logs for potential memory limit bypass attempts.

Why it matters

The CVE-2026-45763 vulnerability in Suricata allows certain Lua allocation patterns to exceed the configured memory limit, potentially leading to denial-of-service or code execution. Defenders should assess exposure, prioritize verification, and update to version 8.0.5 or later.

• Potential denial-of-service due to excessive memory usage
• Possible code execution or privilege escalation if Lua rules are used with untrusted input
• Verification of Suricata deployments and Lua rule usage is necessary
• Remediation priority is medium, with a focus on updating to version 8.0.5 or later

Technical summary

The Suricata network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine is vulnerable to a Lua sandbox memory limit bypass in versions 8.0.0 to 8.0.4. This allows certain Lua allocation patterns to exceed the configured memory limit, potentially leading to denial-of-service or code execution. The vulnerability requires Lua rules to be enabled and an affected Lua script/rule to be loaded. Version 8.0.5 contains a fix. As a workaround, disable `security.lua.allow-rules` unless Lua rules are required.

Defensive priority

Defenders should assess exposure and prioritize verification of Suricata deployments using Lua rules, especially those with untrusted or unauthenticated input.

Recommended defensive actions

• Review and update Suricata deployments to version 8.0.5 or later
• Disable Lua rules if not required
• Monitor Suricata logs for potential memory limit bypass attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Suricata versions 8.0.0 to 8.0.4, where the Lua sandbox memory limit is not consistently enforced, allowing certain Lua allocation patterns to exceed the configured limit.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.