Description
Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached during rule parsing/loading rather than by network traffic alone. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, preprocess rules to check that frames are all lowercase and/or only load trusted rulesets.
Published: 2026-09-10
Score: 3.3 Low
EPSS: n/a
KEV: No
Impact: Heap Buffer Overflow
Action: Apply Patch
AI Analysis

Impact

A crafted Suricata rule that uses mixed‑case frame syntax can trigger a heap buffer overflow while the engine is loading signatures. The flaw is exercised during rule parsing, not by network traffic, and can lead to memory corruption that may allow arbitrary code execution or cause the Suricata process to terminate.

Affected Systems

Suricata versions prior to 7.0.16 and 8.0.5 are vulnerable. The security patch is included in 7.0.16 and 8.0.5 and later releases.

Risk and Exploitability

The CVSS score of 3.3 indicates low severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. The rendered heap corruption is reached through rule parsing; based on the description, the likely attack vector is local or remote injection of malicious rule files or a compromise that allows installation of custom rulesets.

Generated by OpenCVE AI on September 11, 2026 at 04:09 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Suricata to version 7.0.16 or later (8.0.5 or newer).
  • Preprocess rule files to ensure that frame syntax is written in lowercase before loading.
  • Load only trusted and verified rule sets to avoid introducing malicious or malformed frames.

Generated by OpenCVE AI on September 11, 2026 at 04:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 11 Sep 2026 09:15:00 +0000

Type Values Removed Values Added
First Time appeared Oisf
Oisf suricata
Vendors & Products Oisf
Oisf suricata

Thu, 10 Sep 2026 21:15:00 +0000

Type Values Removed Values Added
Description Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a crafted rule using mixed-case frame syntax could trigger a heap buffer overflow while Suricata is loading signatures. The issue is reached during rule parsing/loading rather than by network traffic alone. Versions 7.0.16 and 8.0.5 contain a fix. As a workaround, preprocess rules to check that frames are all lowercase and/or only load trusted rulesets.
Title Suricata detect: case-insensitive frame handling can cause heap buffer overflow during rule load
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 3.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Oisf Suricata
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-10T21:02:48.129Z

Reserved: 2026-05-13T07:45:21.250Z

Link: CVE-2026-45761

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-10T21:17:27.677

Modified: 2026-09-10T21:34:14.253

Link: CVE-2026-45761

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-11T09:00:10Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow