by Kastro
Paper/Archive/CVE-2026-22264

CVE-2026-22264

OISF suricata — Suricata detect/alert: heap-use-after-free on alert queue expansion

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
34
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 35.2.352 × 207.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not run untrusted rulesets or run with less than 65536 signatures that can match on the same packet.

Affected

ProductAffectedFixed inSource
suricata< 7.0.14–CNA
suricata>= 8.0.0, < 8.0.3–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
GitHub_M (CNA)7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refgithub.com/OISF/suricata/security/advisories/GHSA-mqr8-m3m4-2hw5refgithub.com/OISF/suricata/commit/549d7bf60616de8e54686a188196453b5b22f715refgithub.com/OISF/suricata/commit/5789a3d3760dbf33d93fc56c27bd9529e5bdc8f2refgithub.com/OISF/suricata/commit/ac1eb394181530430fb7262969f423a1bf8f209brefredmine.openinfosecfoundation.org/issues/8190