Suricata, a network intrusion detection system, has a use‑after‑free flaw in its decompress transform pipeline. When certain detection rules chain transforms, the decompress step can read from a buffer that has already been freed, causing the engine to crash while processing traffic. The vulnerability does not provide code execution or data exfiltration; it only results in a crash that disrupts the Suricata process.

The vulnerability affects OISF Suricata versions 8.0.0 through 8.0.4. Deployments running those releases and using rule chains that combine gunzip or zlib_deflate with a max‑size greater than 4096 after another transform are impacted until a patched release is applied.

The CVSS score of 5.9 indicates moderate severity. No EPSS data is available and the issue is not listed in the CISA KEV catalog. Triggering the crash requires a malicious rule authoring an unsupported transform sequence, meaning that the risk is limited to environments where such rules can be introduced. In typical production scenarios lacking adversarial rule sets, the risk reduces to accidental crashes from legacy or misconfigured rules.