These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A use-after-free vulnerability exists in Suricata before version 8.0.7. The vulnerability occurs when a transaction is inspected by rules that use http.response_header with and without a transform. This issue impacts systems using Suricata for network traffic analysis and security monitoring. The vulnerability can lead to potential remote code execution and disruption of network security monitoring. Netwo [truncated]
A critical vulnerability was found in Suricata before version 8.0.7, leading to an invalid free due to a DoH2 type confusion when app-layer.protocols.doh2 is enabled, the default in Suricata 8.x versions. This issue requires immediate attention from defenders responsible for Suricata deployments to assess exposure and prioritize upgrading to Suricata version 8.0.7 or later. The vulnerability's impact incl [truncated]
A deadlock condition exists in Suricata's IP defragmentation code when processing fragmented traffic with an encapsulated tunnel protocol whose payload is also fragmented, affecting versions 8.0.0 through 8.0.4. This issue is fixed in version 8.0.5. The vulnerability can cause network service disruption, and defenders should assess their exposure and prioritize updating to version 8.0.5 or later. The issu [truncated]
A vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, allows a Lua rule to corrupt Lua detection state and potentially bypass the restricted Lua sandbox if too many flow variables are registered. This issue affects Suricata versions 8.0.0 through 8.0.4 and can cause Suricata to crash. A fix is available in version 8.0.5. As [truncated]
A vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, could allow an attacker to cause a denial of service by consuming excessive memory through repeated crafted UDP traffic. The issue is fixed in versions 7.0.16 and 8.0.5. This vulnerability affects network security monitoring and intrusion detection capabilities, requiring [truncated]
A vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, could allow an attacker to cause excessive memory consumption, potentially resulting in a denial of service. The issue, which affects Suricata versions 8.0.0 through 8.0.4, is due to the LDAP transaction state storing an unbounded number of responses. This can be exploite [truncated]
A vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, could allow a malicious rule to potentially overwrite any file on the file system on rule load or reload. This issue is addressed in versions 7.0.16 and 8.0.5. The vulnerability has a medium CVSS score of 4.4, indicating a moderate severity level. Network security teams u [truncated]
A vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, allows crafted NFS traffic to cause excessive memory consumption, potentially leading to denial of service. The issue is fixed in versions 7.0.16 and 8.0.5. This vulnerability is particularly concerning because it can be exploited through specially crafted NFS traffic, wh [truncated]
A vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, could allow crafted DNP3 traffic to cause excessive memory consumption, potentially resulting in denial of service. The issue is addressed in versions 7.0.16 and 8.0.5. Defenders should be aware of the potential impact on network security and prioritize updates or workaro [truncated]
A critical vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, could lead to a denial of service via crafted HTTP/2 traffic. This CVE was published on 2026-09-10T22:16:56.250Z and was last modified on 2026-09-11T18:24:59.400Z. The vulnerability, tracked as CVE-2026-45764, is due to a type confusion issue caused by a protocol [truncated]
A vulnerability in Suricata's IP defragmentation tracker lookup could lead to a remote packet-triggered crash and denial of service. This issue affects Suricata versions prior to 7.0.16 and 8.0.5. The vulnerability allows an IPv6 fragment to be associated with an IPv4 defragmentation tracker under crafted fragmented IPv4/IPv6 traffic. Network defenders and administrators using Suricata should assess their [truncated]
A vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, allows for a heap buffer overflow during rule parsing/loading when a crafted rule with mixed-case frame syntax is used. This issue is not triggered by network traffic alone but during the loading of signatures. Fixed versions are 7.0.16 and 8.0.5. A workaround is to prepr [truncated]
A vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, could allow an attacker to cause excessive CPU usage and denial of service via crafted HTTP traffic with large Content-Disposition headers. The issue affects versions prior to 7.0.16 and 8.0.5. A workaround is available using a specific rule.
A vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, allows for a crash when processing network traffic with certain detection transforms chained. This issue, present in versions 8.0.0 through 8.0.4, is resolved in version 8.0.5. A workaround is to avoid rules that chain `gunzip` or `zlib_deflate` with `max-size` bigger tha [truncated]
A vulnerability in Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, could allow an attacker to cause an inspection pointer to reference freed memory. This issue is reached during specific network traffic processing and requires a specific but not malicious rule. The vulnerability is addressed in versions 7.0.16 and 8.0.5.
A vulnerability in Suricata's HTTP/2 decompression path could lead to excessive memory allocation, potentially causing a denial-of-service condition. This issue affects Suricata versions prior to 7.0.16 and 8.0.5. The vulnerability is due to the lack of an effective upper bound on the decompressed response-body buffer, allowing a crafted HTTP/2 DATA payload to cause excessive memory allocation.
Suricata, a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine, has a memory limit bypass issue in Lua rule execution. The issue occurs when Lua rule execution is enabled, and the Lua sandbox memory limit is not consistently enforced for new allocations. Certain Lua allocation patterns could exceed security.lua.max-bytes without triggering the intended [truncated]